17.09.2024
1 min
1124
The Federal Bureau of Investigation (FBI) has officially linked the largest cryptocurrency exchange hack in history, targeting Binance, to the North Korean hacking group TraderTraitor. The attack, which took place on October 29, resulted in the theft of over $6.3 billion in cryptocurrency, and investigators are already tracking the movement of the stolen funds through the blockchain.
Following the attack, Binance temporarily suspended deposits and withdrawals while security specialists assessed the safety of its infrastructure. A preliminary investigation suggested that the attackers may have gained access to internal systems through a compromised DevOps engineer’s laptop. This allowed them to access an internal service container and initiate unauthorized cryptocurrency withdrawal transactions.
Further investigations uncovered additional entry points, although Binance has not yet disclosed all the technical details of the attack. The company pledged to fully compensate users for their losses using its Secure Asset Fund for Users (SAFU) and corporate funds. Binance has already allocated more than $6.34 billion to cover the consequences of the incident and began gradually restoring withdrawals on November 1.
Although Binance itself did not identify those responsible for the attack, US investigators officially linked the cryptocurrency theft to North Korea. In an advisory issued on October 31, the FBI stated that the operation was carried out by TraderTraitor, a hacking group specializing in attacks against cryptocurrency companies and the theft of digital assets.
“The Federal Bureau of Investigation announces that the Democratic People’s Republic of Korea (North Korea) is responsible for the theft of more than $6 billion in virtual assets from cryptocurrency exchange Binance on or about October 29, 2026.”
According to the FBI, the attackers have already begun converting the stolen assets primarily into Ethereum (ETH). US law enforcement authorities believe the next stage will involve laundering the funds through decentralized finance (DeFi) services and instant cryptocurrency exchange platforms. Such transactions allow assets to be moved rapidly between different blockchains, making it more difficult to trace their origins.
The FBI, together with the US Secret Service (USSS) and the Internal Revenue Service Criminal Investigation division (IRS-CI), published a list of cryptocurrency addresses used to store or transfer the stolen funds. The list includes dozens of Bitcoin and Ethereum wallets linked to TraderTraitor.
US law enforcement authorities urged cryptocurrency exchanges, THORNode and RPC node operators, DeFi platforms, instant exchange services, and blockchain analytics companies to block transactions associated with the identified addresses. These measures are intended to disrupt further movement of the assets and prevent the hackers from cashing out the stolen billions.
One of the key details of the incident was the possible compromise of a Binance employee’s work laptop. According to the company’s preliminary findings, the attackers exploited access to a DevOps engineer’s device to infiltrate a service container connected to the exchange’s infrastructure.
After gaining access to this environment, the attackers were able to generate unauthorized cryptocurrency withdrawal requests. In effect, they used the platform’s internal infrastructure to execute transactions that had not been authorized by the rightful owners of the assets.
After detecting the attack, Binance suspended deposits and withdrawals to assess its systems and prevent further losses. Investigators subsequently identified other potential points of compromise, meaning the initial theory involving an infected laptop does not fully explain the circumstances of the breach.
The exchange stated that it would cover the financial impact of the incident using its SAFU fund and corporate reserves. Withdrawals began to resume gradually following security checks. According to the company, users should not suffer financial losses as a result of the stolen assets.
TraderTraitor is believed to be a North Korean hacking group focused on financially motivated cyberattacks, cryptocurrency theft, and the compromise of blockchain-related companies. Its members use social engineering, targeted phishing, malware, and vulnerability exploitation to infiltrate corporate networks.
This is not the first time US law enforcement authorities have linked North Korean hackers to large-scale cryptocurrency thefts. In February 2025, cryptocurrency exchange Bybit lost approximately $1.5 billion in Ethereum following an attack targeting its transaction approval mechanism.
In that incident, the attackers manipulated the information displayed during the signing of a transfer from a cold wallet. As a result, exchange employees unknowingly approved a transaction that transferred control of the funds to the attackers. The FBI subsequently attributed the incident to North Korean hackers.
The new attack on Binance significantly exceeded the previous incident in terms of the value of stolen assets. With losses exceeding $6.3 billion, it represents the largest known cryptocurrency exchange hack in the industry’s history.
US law enforcement authorities are continuing to track the stolen funds and are urging cryptocurrency market participants to block transactions associated with the attack. Binance is gradually restoring its services and maintains that it will compensate affected customers. However, the full picture of how the attackers infiltrated its infrastructure remains unclear.
