The US Federal Bureau of Investigation (FBI) has officially attributed the theft of over $6 billion in virtual assets from Binance to TraderTraitor, an elite North Korea-aligned hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. The FBI, along with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation Service (IRS-CI), said they observed the threat actor converting stolen assets primarily into Ethereum (ETH). “These assets are expected to be further laundered by converting them using DeFi and instant exchange services while preparing them for later stages of laundering,” the FBI said in a statement. The agency also provided a list of wallet addresses that attackers are said to use to launder stolen assets. The development comes as Binance said it resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident. “Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services,” Binance said in a statement. “We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident.” The loot dwarfs the $1.46 billion looted from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin. “This single incident almost doubles the total cryptoassets stolen by the regime,” said blockchain analysis firm Elliptic. “Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen more than $6.5 billion in crypto assets in recent years.” Of the $6.43 billion stolen by TraderTraitor, Tether, Circle, Ripple, Arbitrum and Optimism have frozen $2.85 billion of on-chain assets. TraderTraitor is the name assigned to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading malware-laden applications. The group is known to be active since at least 2020. In recent years, the adversary has been blamed for cryptocurrency thefts targeting DMM Bitcoin, Bybit, KelpDAO, and Bitget. Reports from SentinelOne, Zscaler ThreatLabz, and Microsoft have revealed that TraderTraitor continues to hone its craft, using Trojanized Terraform providers as a malware distribution vector and leveraging front companies to carry out employment-themed attacks against individuals involved in cybersecurity, artificial intelligence, blockchain, and talent recruiting companies. The poisoned Terraform provider is used to deliver a Bash loader that selects and downloads malware tailored to the victim’s operating system. This includes a cross-platform implant called FLATROOF, which extracts sensitive victim data using a Python-based information stealer before finally removing the ROOFDECK backdoor for full remote control. The activity once again demonstrates how North Korean threat actors continue to abuse trusted developer workflows via trojanized Terraform providers to deliver cross-platform malware on macOS, Linux, and Windows systems, and gain persistent access. TraderTraitor’s modus operandi, like other North Korea-linked campaigns such as Lazarus Group’s Operation Dream Job and Famous Chollima’s Contagious Interview, uses recruitment-themed lures as a pretext to convince victims to execute malicious code. The social engineering phase is enhanced by the use of artificial intelligence (AI) to create convincing decoys, create fake personas, and evade detection. “The actor leveraged custom domains, social media profiles, and industry-specific knowledge to pose as recruiters for a fake AI-powered blockchain intelligence company, using software engineer themed opportunities to initiate contact and schedule interviews with people who participated in the outreach,” Microsoft said. “In this short period of time, Jade Sleet carried out a similar orientation with employment issues using two additional front companies, supported by comparable infrastructure and relevant domain knowledge.” Update Binance said it has resumed withdrawals for all 15 networks, after it began restoring withdrawals in phases at 6 am UTC on November 1, 2026, following the record cryptocurrency heist. “Between 06:00 and 15:30 UTC on November 1, we processed $4.649 billion in withdrawals and $1.01 billion in deposits, resulting in a net outflow of approximately $3.64 billion,” Binance said in an X post. “Our team continues to rigorously test the remaining networks and assets.”
