FBI attributes massive Binance hack to North Korean group

The FBI announced on Saturday that the hacker group TraderTraitor is responsible for a massive attack on the cryptocurrency exchange Binance. According to the US federal police, the group stole more than 6 billion dollars in digital assets. This event is described by experts as the largest theft of cryptocurrencies in history.

Binance, the world's largest exchange by trading volume, first disclosed the attack on Thursday. The company reported that assets worth approximately 6.3 billion dollars (5.6 billion euros) were affected. Binance described the breach as a "complex attack" involving several entry points, noting that it may have occurred via the laptop of an IT employee.

Tracking the stolen assets

The FBI stated that investigators observed the perpetrators converting the stolen funds primarily into Ether (ETH). The assets were then allegedly moved through decentralised finance services and rapid exchange platforms to obscure the trail. To assist in the investigation, the FBI released a list of around 500 Ethereum addresses that it believes TraderTraitor uses for money laundering. The agency has called on cryptocurrency exchanges and other industry service providers to block transactions involving these addresses.

Prior to the FBI's statement, the analysis firm TRM Labs had already expressed suspicion toward TraderTraitor. According to Tagesschau, the firm stated it was "pretty sure" the group was behind the attack, noting that several characteristics matched previous North Korean cyber thefts. TraderTraitor is considered part of the Lazarus group, which has been linked to North Korean intelligence services.

Binance response and user impact

Binance, which reports having 335 million users, stated on the platform X that it has already secured replacement assets for 90 percent of the stolen value using its own resources. The company has allocated more than 6.34 billion dollars to cover the losses. While the company pledged to fully absorb the financial consequences, it noted that the remaining ten percent would take more time to replace because those specific digital assets are less easily available.

Following the attack, Binance temporarily suspended all deposits and withdrawals. The company announced that withdrawals would be resumed in stages, with the first phase already opened in the network. Earlier, Binance reported that partners had frozen approximately 3 billion dollars in crypto assets in an attempt to contain the theft.

In our assessment, this incident highlights the extreme vulnerabilities within the digital financial infrastructure used by hundreds of millions of people. While Binance claims there is no evidence that private keys for user accounts were stolen, the scale of the breach demonstrates how concentrated risks are within these massive, centralised platforms. The involvement of state-linked actors further complicates the landscape, turning financial platforms into arenas for international geopolitical conflict.

Context of the group

The TraderTraitor group is linked to the Lazarus network, which was famously associated with the 2014 attack on Sony Pictures. According to taz, TraderTraitor is also held responsible for a 1.5 billion dollar theft at the Bybit exchange in February 2025. North Korea remains under extensive international sanctions due to its nuclear and missile programmes.

This piece was generated automatically by an AI model from the sources listed below. It has not been reviewed by a human editor.

Sources

• Krypto-Börse Binance: FBI macht Nordkorea für Hack bei Krypto-Börse verantwortlich — taz
• FBI macht Nordkorea für Hackerangriff auf Binance verantwortlich — Tagesschau