The US Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets from Binance to TraderTraitora North Korean-aligned elite hacker group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
The FBI, along with the United States Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said they observed the malicious actor converting the stolen assets primarily into Ethereum (ETH).
“It is expected that these assets will then be further laundered by converting them using DeFi and instant exchange services as they prepare them for further laundering stages,” the FBI said in a statement.
The agency also provided a list of wallet addresses that attackers would use to launder stolen assets.
This development comes as Binance announced that it had resumed the first phase of withdrawals starting today between 6 a.m. and 9 a.m. UTC after being paused following the incident.
“Since the incident, our teams have taken precautionary measures to protect the platform, conducted security assessments, and worked to verify the readiness of affected services,” Binance said in a statement.
“We aim to reinstate withdrawals gradually as we complete safety and readiness checks. Deposit services remain open and are not affected by the incident.”
This theft dwarfs the $1.46 billion looted from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen from 11 blockchains, 82% of which were from Ethereum and Bitcoin.
“This single incident almost doubles the total cryptoassets stolen by the regime,” blockchain analytics firm Elliptic said. “Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), have allegedly stolen more than $6.5 billion in cryptoassets in recent years.”
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion in assets were frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
TraderTraitor is the name given to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading applications containing malware. The cluster is known to have been active since at least 2020.
In recent years, the adversary has been attributed to cryptocurrency heists targeting DMM Bitcoin, Bybit, KelpDAO and Bitget.
Reports from SentinelOne, Zscaler ThreatLabz, and Microsoft have revealed that TraderTraitor continues to hone its expertise, using Terraform Trojan vendors as a malware distribution vector and leveraging shell companies to conduct thematic targeting against individuals involved in cybersecurity, AI, blockchain, and talent recruitment companies.
The poisoned Terraform provider is used to deliver a Bash loader that selects and downloads malware tailored to the victim’s operating system. This includes a cross-platform implant called FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before finally abandoning the ROOFDECK backdoor to gain complete remote control.
This activity once again demonstrates how North Korean threat actors continue to abuse trusted developers’ workflows via Terraform Trojan providers to deliver cross-platform malware to macOS, Linux, and Windows systems and gain persistent access.
TraderTraitor’s modus operandi, like other North Korea-related campaigns such as Lazarus Group’s Operation Dream Job and Famous Chollima’s Contagious Interview, uses recruitment-themed lures as a pretext to convince victims to execute malicious code. The social engineering phase is enhanced by the use of artificial intelligence (AI) to create convincing lures, create fake personas, and evade detection.
“The actor leveraged custom domains, social media profiles, and industry-specific knowledge to pose as recruiters for a spoofed AI-based blockchain intelligence company, using software engineer-themed opportunities to make contacts and schedule interviews with individuals participating in outreach,” Microsoft said.
“In this short time, Jade Sleet conducted similar thematic targeting using two additional front companies, supported by comparable infrastructure and relevant domain knowledge. »
Update
Binance said it had resumed withdrawals for all 15 networks, after beginning to restore withdrawals in phases at 6 a.m. UTC on November 1, 2026, following the record cryptocurrency heist.
“Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” Binance said in an article X. “Our team continues to rigorously test the remaining networks and assets.”
Gn bussni
