The hacker group TraderTraitor, of North Korean origin, is believed to be behind the Binance hack, according to the FBI. In the attack on the exchange, 6 billion in cryptocurrency was stolen, the largest haul ever in such a heist.
The group is known by several names in addition to TraderTraitor, such as the Lazarus Group, Jade Sleet, and APT38. Analyses by TRM Labs and Chainalysis had established the link between the Binance theft and this cyber threat before the FBI did.
According to Binance, the theft began with a compromised laptop belonging to a DevOps engineer. Using that device, the attackers gained access to a service container and submitted unauthorized withdrawal requests. Approximately $6.36 billion disappeared, spread across ten blockchains. The majority of the loot was stolen within twenty minutes.
Money laundering via DeFi
The FBI has observed that TraderTraitor is primarily converting the stolen funds into Ethereum. The agency expects the attackers to then launder the funds through DeFi platforms and instant swap services. Together with the U.S. Secret Service and IRS-CI, the FBI is asking exchanges, node operators, and other providers to block transactions. To achieve this, the FBI published a list of 628 addresses that must be blocked. This includes 608 addresses for Ethereum, 19 for Bitcoin, and one for Solana. According to Binance, blockchain partners have already frozen approximately $3 billion “on-chain.”
A familiar pattern
Lazarus has been targeting employees of crypto companies for years, for example by posing as employees of investment firms via Telegram. Fake job postings from the “Operation DreamJob” campaign are also designed to trick victims into installing malware. At Bybit (with $1.5 billion stolen in February 2025) and DMM Bitcoin ($308 million in May 2024), the theft also began with a compromised computer. This year, Drift ($280 million) and Bitget ($387.5 million) followed. According to Chainalysis, North Korean hackers stole at least $2.02 billion in 2025, 51 percent more than the previous year.
Binance itself announced on Sunday that it is resuming the first phase of payouts. Approximately 95 percent of the affected amount has now been covered. The remainder consists of less liquid tokens that are being purchased through the market and OTC channels. Deposits remained unaffected. “Binance is bearing the financial impact of the stolen funds. These losses will not be passed on to users,” the company stated.