News / Industry
FBI links record $6.3 billion Binance crypto theft to North Korea
The FBI tied the record $6.3 billion Binance crypto theft to North Korea's TraderTraitor group. The entry point was one compromised DevOps engineer's laptop.
The FBI has attributed the record $6.3 billion Binance crypto theft to North Korean state hackers, and by Binance's own account the break began with a single compromised DevOps engineer's laptop. The bureau named a unit it tracks as TraderTraitor, publicly known as Lazarus Group and APT38, and said North Korean actors were behind the theft of more than $6 billion in virtual assets on or about October 29, 2026. That makes it the largest cryptocurrency theft on record, and it turns one endpoint into the first link in a chain that ended with roughly $6.36 billion leaving exchange wallets across ten blockchains in about twenty minutes. We examined the exposure lesson of the heist itself when the loss first surfaced. This is the follow-up on who did it and how it started.
| Key fact | Detail |
|---|---|
| Amount | Roughly $6.3 billion, reported ($6.36 billion per TRM Labs); the largest crypto theft on record |
| Victim | Binance |
| Attribution | FBI: North Korea, a unit it tracks as TraderTraitor, publicly known as Lazarus Group and APT38 |
| Entry point | A compromised DevOps engineer's laptop, per Binance's initial investigation |
| Timeline | October 29 (Binance probes a potential $5.8 billion loss) to November 1 (FBI attribution), 2026 |
| Status | Binance says it has covered about 95 percent of the loss; laundering and recovery efforts continue |
What happened
BleepingComputer first reported on October 29 that Binance was investigating suspicious transfers that early tracking put at up to $5.8 billion, with a spokesperson saying only that user funds were safe. Within a day the estimate hardened and the cause came into view. Binance linked the theft to a compromised DevOps engineer's laptop, and blockchain intelligence firm TRM Labs put the loss at about $6.36 billion drained from Binance wallets across ten blockchains, most of it in roughly twenty minutes beginning at 20:05 UTC. By the exchange's account, the laptop gave the attacker a path into an internal service container, from which unauthorized withdrawal transactions were submitted. Binance said it found no evidence of a leaked wallet private key, and co-CEO Richard Teng was careful to note that the attacker "did not simply use one engineer's permissions, and this was not a single 'one-click' action," adding that the company had uncovered additional points of breach it was still investigating.
On November 1, the FBI tied the heist to North Korea, naming the state-sponsored unit it tracks as TraderTraitor, also known as Lazarus Group, Jade Sleet, and APT38. The government attribution followed the forensic work rather than leading it: TRM Labs and Chainalysis had already pinned the theft on TraderTraitor before the bureau spoke. Not everyone accepted the finding. Reuters reported that President Trump publicly questioned it, saying "we don't know if it's North Korea," a reminder that even a federal attribution can draw political friction. The technical consensus, across the FBI and two major chain-analysis firms, pointed one way.
The FBI also described where the money went. TraderTraitor was converting the stolen assets mainly into Ether and was expected to launder them further through decentralized finance platforms and instant swap services. The bureau, with the U.S. Secret Service and IRS Criminal Investigation, published 628 wallet addresses tied to the operation, 608 on Ethereum, 19 on Bitcoin, and one on Solana, and asked exchanges and other virtual asset service providers to block any transaction touching them. That dispersal is the group's signature. The same actor carried out the $1.5 billion Bybit theft in February 2025, which the FBI traced to a compromised Safe Wallet developer's computer and a manipulated transaction request, then watched the funds scatter across a web of addresses and route toward Bitcoin. The method is built to outlast the freeze-and-trace scramble that follows a large heist. Keep the two events separate, though: Bybit was a different exchange, a different year, and roughly a quarter of the sum, even if the playbook and the attacker are the same.
Binance moved to contain the damage. It halted withdrawals, and partners froze large balances early, with Tether locking more than $1.5 billion in USDT and Circle more than $800 million in USDC. The exchange told users it would "bear the financial impact of the stolen funds," and later put its coverage of the loss at about 95 percent, buying replacement tokens from its reserves while it bought back the remaining, less liquid assets.
Why it matters
Two things lift this above an unusually large robbery. The first is where the proceeds go. United Nations assessments have for years tied North Korean cryptocurrency theft to the financing of the regime, estimating that stolen crypto may account for as much as half of its foreign income and cumulatively billions of dollars since 2017, much of it directed at sanctioned weapons programs. An operation of this size, about four times the Bybit theft the same actor pulled off a year earlier, moves hard currency to a sanctioned state on a scale that frozen stablecoins and reimbursed customers do not undo. That makes an exchange breach a national security event as much as a financial one.
The second is the root cause, because it is not exotic. The entry point was an endpoint in the hands of a person with access. That is the same class of initial access behind the Bybit heist, which the FBI traced to a compromised developer machine, and behind a long line of breaches in industry after industry. The DPRK's crypto playbook is consistent: target the people and devices that hold privileged access through social engineering and malware, compromise an identity or an endpoint, manipulate a legitimate transaction or signing workflow from the inside, then move and launder fast. None of those steps requires breaking the chain itself. They require reaching one trusted laptop and the access behind it. That is an attack surface of identities and endpoints before it is a cryptography problem, and the discipline for shrinking it is exposure management.
It also fits a brutal stretch of incidents, from a record-setting October for cyber losses to the most active ransomware operations of the year, in which the way in was something reachable and human rather than a novel flaw. The actors differ in skill and motive. The opening move keeps rhyming.
The largest crypto theft on record did not start by breaking the cryptography. It started with one trusted laptop and the access behind it.
The Threatless read
Strip the record figure away and the lesson is about identity and endpoints. A single laptop, reachable and holding privileged access to internal systems, is not a footnote in an incident like this. It is the incident's beginning. For a state actor with the patience to target the right person and the resources to see the theft through, that one endpoint was the whole opening move, and the cryptography it never had to touch was almost beside the point.
The defensive question that follows is not how strong the vault is. It is how many identities and endpoints can reach what matters, which of them an attacker can actually get to, and which of those paths can be cut. Keeping that picture current is the premise behind Threatless CTEM: AI-native exposure management that treats a reachable, over-privileged endpoint as work to close rather than as a line in a breach report later, the ongoing discipline of continuous threat exposure management. The heist was North Korean and the sum was historic. The opening was ordinary, and ordinary is where the work is.