New turn in the Binance theft as the FBI names a North Korean group

The theft is of $6.43 billion in crypto assets from Binance, a crypto exchange. Binance paused withdrawals after the incident.

The FBI in the US says that TraderTraitor stole more than $6 billion in crypto assets. The group is North Korea linked. The FBI says that the group converts most of the assets into Ethereum, a crypto currency. Binance said that it restarted phase one of withdrawals. Elliptic, a company that analyzes blockchains, says that this is the largest crypto theft on record.

How it works

TraderTraitor sends fake offers of work to make a person start dangerous code. Microsoft says that the group posed as recruiters for a fake AI blockchain company. A poisoned Terraform provider is a software extension. It installs malware that gives the group full remote control. The group also uses AI to write lures and to make fake personas.

The numbers

• The group stole $6.43 billion across 11 blockchains.
• Tether, Ripple and 3 other firms froze $2.85 billion.
• The record before this was $1.46 billion, from Bybit in February 2025.

What is not known

The reports give no instruction on how the attackers got into Binance. The FBI expects the group to launder the remaining assets with DeFi and instant swap services. DeFi is crypto trade apps that work without a bank.

Insight: Attackers aim at the side door, not the main wall

TraderTraitor reaches victims through fake offers of work and poisoned developer tools. In October, South Korea police tied bank breaches to an open source AI tool. Those attackers hit side systems, such as a portal for loan agents, not core records. This reads as a selection of trusted tools that staff use each day, where AI makes the lure cheap. Look first at the tools and the new staff of your company.