FBI confirms it thinks North Korean hackers hit Binance in record cryptocurrency heist - TechRadar

The FBI has publicly accused a North Korean state-sponsored threat actor of being behind the recent attack on cryptocurrency exchange Binance. One of the largest cryptocurrency exchange platforms on the planet was forced to freeze deposits and withdrawals before confirming a threat actor stole around $6.7 billion worth of different cryptocurrencies.

TraderTraitor Confirmed

Analysts had previously suggested the heist was the work of a known North Korean state-sponsored group called TraderTraitor. The FBI has now issued an official statement naming TraderTraitor as the attackers, confirming they are part of the larger Lazarus Group - a massive cybercriminal operation on North Korea's payroll.

The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as 'TraderTraitor.'

Attack Method

Binance revealed that one of its DevOps engineers had their laptop compromised, which "gave an attacker access to a service container, where they submitted unauthorized withdrawal transactions." Some speculate the engineer fell victim to a fake job scam, while others suggest it was a romance scam. The attackers siphoned funds from 10 different blockchain networks, including Bitcoin, Ethereum, Solana, and XRP.

For Ethereum, the attackers even set up a smart contract that automatically withdrew any new money flowing into the account. The positive aspect is that these were not user funds but rather the exchange's own assets. Binance has a security fund called SAFU (Secure Asset Fund for Users) designed to protect user assets during such incidents.

North Korean Tactics

The cybersecurity community has long warned about Lazarus Group targeting Western organizations. The group runs two major scam campaigns: Operation DreamJob and Contagious Interview, both aimed at software developers, blockchain programmers, and DevOps professionals. In these scams, attackers create fake companies and job offers to infect targets' computers with malware.

The FBI has shared a list of wallets containing the stolen funds and has requested blockchain service providers to block transactions with these addresses. North Korea has not commented on the allegations, though the country is under heavy US sanctions that prohibit business with North Korean entities.