TraderTraitor linked by FBI to $6.3 billion Binance heist
Binance heist put at $6.3 billion
Binance, a crypto exchange where people buy and sell digital assets, lost $6.3 billion in a heist last week. The FBI and several analysis firms say a North Korean hacking group called TraderTraitor was behind it.
The report describes it as the largest theft in crypto history. It was more than four times the $1.5 billion taken from Bybit in February 2025, an attack the FBI also blamed on TraderTraitor.
Main points from the report
- The FBI and analysis firms link TraderTraitor to the Binance theft.
- The group often starts with fake job approaches that lead to malware on an employee computer.
- U.S. agencies say the group works to raise and launder funds for North Korea.
- North Korea denies involvement.
How the group is identified
The name TraderTraitor appeared in an April 2022 advisory from the FBI, the Cybersecurity and Infrastructure Security Agency and the Treasury Department. That advisory described malware hidden in crypto trading apps and attacks on exchanges, DeFi protocols and investors dating to at least 2020.
The group is also tracked under the names Jade Sleet, UNC4899 and Slow Pisces. Researchers place it within a wider network of North Korean hacking operations often called Lazarus.
Chainalysis and TRM Labs said they attribute the Binance hack to TraderTraitor with a high degree of confidence. Chainalysis said its strongest evidence was stolen Binance funds being combined with proceeds from a September hack of about $388 million at Bitget, which had been attributed to North Korea.
Fake job interviews and malware
Binance Chief Security Officer Jimmy Su said a software engineer was contacted in September by someone posing as a project director. A person posing as human resources interviewed the engineer and shared a social media account with personal photos. A second interview, with a supposed chief executive, ended with instructions to download a coding assignment.
The assignment contained malware. The report says that later allowed attackers to use the machine and an internal AI tool to attack the exchange.
A similar pattern was reported in the DMM Bitcoin case. In March 2024, a person posing as a LinkedIn recruiter contacted an employee of Ginco, a Japanese wallet software company. A supposed coding test sent by the recruiter contained malicious code that compromised the employee computer. Two months later, the attackers used stolen session information to impersonate the employee and enter Ginco communications system. Investigators said they likely used that access to manipulate a transaction request involving DMM Bitcoin.
DMM lost about 4,503 bitcoin, worth $308 million, a loss that led to the platform closure.
Other attacks linked to the group
The FBI linked TraderTraitor-affiliated hackers to three 2023 thefts: AlphaPo at $60 million, CoinsPaid at $37 million and Atomic Wallet at $100 million. LayerZero forensic investigators assessed that the group was behind an April theft of $292 million from KelpDAO.
An October 2025 report by the Multilateral Sanctions Monitoring Team, an 11-country group tracking North Korean sanctions violations, placed TraderTraitor within the Reconnaissance General Bureau 110 Research Institute. The report said a specialist crypto-theft team was formed in 2016-2017 by that bureau.
What North Korea says
Pyongyang denies involvement. Kim Yo Jong, sister of leader Kim Jong Un, dismissed the FBI finding as absurd rhetoric in a statement.
U.S. agencies said in 2022 that the hackers would keep targeting crypto companies to generate and launder funds to support the North Korean regime. The report also states the North Korean government has, at least on one occasion, attempted to use USDT, a stablecoin, to buy Russian oil.
Where the stolen funds go
Analysts said the goal goes beyond taking funds. The group seeks to launder the money and make it usable. In earlier operations, over-the-counter traders converted crypto into fiat currencies, which are government-issued currencies such as dollars, for the North Korean government, the report said.
Analysts also said members mostly operate outside North Korea and are becoming more decentralised across dozens of countries, based on partner data and legal actions related to DPRK-related IT workers.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Liquid Network Restarts Block Production After $320M Bitcoin Exploit
BNY and Citadel complete triparty repo using tokenized Treasury
