FBI says North Korea's TraderTraitor hackers were behind the record $6.3bn Binance crypto heist and are now laundering the haul
Binance halted all withdrawals after a hack through a single engineer's laptop drained an estimated $6.3bn — surpassing the previous record $1.5bn Bybit breach in 2025.Kim Jong Un, whose country's TraderTraitor unit carried out the Binance raid using access gained through a compromised DevOps engineer's laptop, according to investigators.
The $6.3bn theft from Binance on 29 October — four times larger than any previous crypto heist — was carried out in roughly 20 minutes by North Korea's elite TraderTraitor unit, the FBI confirmed on Saturday alongside the US Secret Service and IRS Criminal Investigation. Hackers gained access via a compromised engineer's laptop and additional "points of breach," then drained funds across ten blockchains before converting the haul into Ethereum ahead of further laundering through decentralised finance platforms.
Binance co-CEO Richard Teng says the company has already restored 90% of the stolen assets from its SAFU reserve fund, futures insurance fund and corporate treasury — and promises users will bear no losses.
TraderTraitor is linked to North Korea's wider Lazarus Group, which also carried out the $1.5bn Bybit hack in 2025; experts warn the Binance attack shows AI may now be supercharging the regime's already industrial-scale crypto theft operation.
Withdrawals, suspended since the hack, are expected to reopen on Sunday — but the FBI has warned crypto exchanges to block a list of addresses tied to the North Korean actors as laundering continues.