CoinDesk
The FBI has linked North Korean hacking group TraderTraitor to a $6.3 billion theft from Binance, the largest in crypto history. The loss is more than four times the $1.5 billion stolen from Bybit in February 2025, an attack the FBI also attributed to the group. North Korea denies involvement in the Binance theft.
Why it matters
TraderTraitor has repeatedly used recruitment pitches and compromised software suppliers to reach crypto companies' systems, according to FBI findings and Bybit's investigation. Binance security chief Jimmy Su said an engineer was approached by someone posing as a project director and later downloaded a coding assignment containing malware onto a work computer.
In another attack, investigators said a fake recruiter targeted an employee of Japanese wallet software company Ginco. They said the attackers likely used access to manipulate a transaction request from DMM Bitcoin, which lost about 4,503 BTC, then worth $308 million. The loss contributed to the exchange's closure.
Market impact
The Binance theft highlights the risks that compromised employees and transaction approval systems pose to exchanges and custodians. U.S. agencies have warned that TraderTraitor targets crypto companies to generate and launder funds for the North Korean regime.
Chainalysis said its strongest evidence linking the group to Binance was the combination of stolen funds with proceeds from the roughly $388 million Bitget hack, which had been attributed to North Korea. Investigators can trace transaction records to identify services where transfers or conversions can be disrupted.
Frequently asked questions
-
How did the attackers reach a Binance employee's work computer?
Binance security chief Jimmy Su said an engineer was approached by someone posing as a project director and later downloaded a coding assignment containing malware onto a work computer.
-
How does the Binance loss compare with the Bybit theft?
The $6.3 billion Binance loss is more than four times the $1.5 billion stolen from Bybit in February 2025. The FBI attributed both attacks to TraderTraitor.
-
What happened to DMM Bitcoin after its theft?
DMM Bitcoin lost about 4,503 BTC, then worth $308 million. The loss contributed to the exchange's closure.
-
What evidence did Chainalysis cite for linking TraderTraitor to Binance?
Chainalysis said its strongest evidence was that stolen Binance funds were combined with proceeds from the roughly $388 million Bitget hack, which had been attributed to North Korea.
-
How has North Korea responded to the Binance attribution?
North Korea denies involvement in the Binance theft.
WatcherGuru
Crypto News
Crypto Rank News
WuBlockchain
TheBlock
Lookonchain