North Korea's TraderTraitor Blamed for Record $6.43 Billion Binance Hack
The FBI has formally pinned the largest cryptocurrency theft in history on TraderTraitor, a North Korean state-aligned hacking group operating under a constellation of aliases including Jade Sleet, Slow Pisces, and UNC4899. Working alongside the Secret Service and IRS Criminal Investigation, the Bureau confirmed that over $6.43 billion in virtual assets were stolen, with the group primarily converting the proceeds into Ethereum.
According to the FBI, the stolen funds are being run through DeFi protocols and instant swap services as part of a multi-stage laundering operation. The agency published a list of wallet addresses tied to the ongoing wash cycle, which is about as much as law enforcement can practically do when the thief is a sovereign state.
Binance, for its part, said it has resumed phase one of withdrawals after briefly pausing them following the incident. The exchange insists deposits were unaffected throughout, and that it is restoring services progressively as internal security checks complete. Whether customers find that reassuring is another matter.
The scale here is genuinely staggering. The Bybit hack in February 2025, which briefly held the record at $1.46 billion, now looks almost modest by comparison. This Binance heist spread across 11 blockchains, with 82% of the stolen assets sitting on Ethereum and Bitcoin. Blockchain analytics firm Elliptic noted that this single incident nearly doubles everything North Korea-linked actors have stolen across all their crypto operations in recent years, putting the regime's total haul somewhere north of $6.5 billion.
Some of the damage has been contained. Tether, Circle, Ripple, Arbitrum, and Optimism have collectively frozen $2.85 billion of the stolen assets on-chain. That still leaves well over $3.5 billion unaccounted for and moving.
TraderTraitor has been at this since at least 2020, with a track record that includes hits on DMM Bitcoin, Bybit, KelpDAO, and Bitget. The group's standard playbook involves convincing targets to install trojanised software, often through elaborate fake recruitment campaigns. Research from SentinelOne, Zscaler, and Microsoft has tracked their evolving toolkit, which now includes poisoned Terraform providers as a malware delivery mechanism. Once executed, a Bash loader drops a cross-platform implant called FLATROOF that vacuums up sensitive data before installing a backdoor named ROOFDECK, giving the attackers full remote access across macOS, Linux, and Windows.
The social engineering side is increasingly polished. Microsoft documented how Jade Sleet built out fake AI-powered blockchain intelligence companies complete with tailored domains, convincing social media profiles, and enough industry jargon to pass as legitimate recruiters. Targets received software engineer job offers, got invited to interviews, and somewhere in that process ran code they absolutely should not have run. AI is reportedly being used to sharpen the lures and build out fake personas at scale.
This mirrors tactics seen in Lazarus Group's Operation Dream Job and the Contagious Interview campaign attributed to Famous Chollima. North Korea has turned recruitment-themed social engineering into something of a national export. The regime does not need nuclear weapons to fund itself when it can apparently just rob cryptocurrency exchanges at will.