FBI Attributes $6bn Binance Heist to North Korean Group TraderTraitor

The FBI has attributed the theft of more than $6bn from the cryptocurrency exchange Binance to the North Korean advanced persistent threat (APT) group TraderTraitor.

In a statement released on 31 October, the FBI, working alongside the US Secret Service and the Internal Revenue Service Criminal Investigation (IRS-CI), identified the group—also known as Jade Sleet, UNC4899, or Slow Pisces—as the party responsible for the massive heist.

Investigators observed the group converting stolen assets primarily into Ethereum (ETH). It is expected that these assets will be further laundered using decentralised finance (DeFi) products and instant swap services to move them through subsequent stages of laundering.

Financial Impact and Asset Recovery

Blockchain analytics firm Elliptic reported that approximately $2.9bn of the stolen funds have been frozen or seized. However, roughly $3.3bn remains outside the reach of issuers.

The remaining assets, valued at approximately $3.25bn, are spread across more than 800 addresses. This includes roughly 584,000 ETH ($1.32bn), 18,327 BTC ($1.42bn), and 233 million XRP. While much of the stolen TRX has been laundered through bridges, Elliptic noted that approximately $439m worth of XRP, SOL, and NEAR has not moved since the initial theft.

Investigation into the Breach

Binance has stated that it will cover the costs of the incident, ensuring that customer funds are not at risk. The exchange is continuing its investigation into the exact cause of the breach.

While the firm initially suggested a compromised DevOps laptop might have been the source, Binance later updated its findings, stating it had uncovered “additional points of breach” in what is described as a complex attack. The operation involved multiple individuals and utilised a self-destruct mechanism designed to destroy tooling and forensic traces during execution, complicating the investigation.

TraderTraitor is believed to have links to the Lazarus Group, APT 38, and AppleJeus. The group has been responsible for several significant cryptocurrency heists, including a $1.5bn theft from Bybit and a $308m attack on the Japanese firm DMM.