Skip to content
NewA calmer, faster ZeroHour
StoryData breachcritical

North Korea's TraderTraitor Steals $6.3B from Binance

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

North Korea's TraderTraitor group stole $6.34 billion from Binance on October 29, 2026, using a compromised DevOps laptop and fake job interviews.

On October 29, 2026, North Korea's TraderTraitor group (also known as Lazarus Group and APT38) drained approximately $6.36 billion from Binance hot wallets across ten blockchains, mostly within 20 minutes. The attack involved a compromised developer's laptop that granted access to a service container and wallet signing infrastructure, with additional exploitation of fake job interview tactics, malware in internal AI coding tools, and Ethereum EIP-7702 delegations. TRM Labs, Chainalysis, and the FBI attribute the heist to the state-sponsored group with high confidence, noting no evidence of leaked private keys. Binance suspended withdrawals, covered the losses from reserves, replenished 95-98% of the funds, and cooperates with law enforcement while North Korea denies involvement.

Key facts
  • North Korea's TraderTraitor (Lazarus Group) stole $6.36B from Binance October 29
  • Attack path: compromised DevOps laptop, fake job interviews, AI tool malware
  • Funds drained in 20 minutes across 10 blockchains; $2.7B later frozen
  • Binance replenished 95-98% using company reserves
  • FBI flagged 608 addresses for laundering
  • North Korea denies responsibility
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 20, 2026Lateral movement began after September infiltration · The Record
  2. Oct 29, 2026$6.36 billion stolen from Binance wallets in 20 minutes · TRM Labs
  3. Oct 29, 2026Issuers froze $2.7 billion in laundered funds · Security Affairs
  4. Nov 2, 2026FBI flagged 608 addresses tied to laundering · SecurityWeek

What each outlet adds

beyond the shared facts
  • TRM LabsPrecise $6.36B breakdown across chains and 20-minute movement timing
  • FBIOfficial attribution to TraderTraitor and 608 laundering address list
  • BinanceDetailed attack path with fake jobs, AI tools, and full loss coverage
  • The RecordMonths-long campaign timeline including June and September stages
  • SecurityWeekFBI address flagging and automation details for laundering
Vendors
Binance
Products
binance wallethot walletwithdrawal service
Threat actors
TraderTraitorLazarus GroupAPT38
Victims
Binance
Organizations
NCC GroupFBITRMChainalysisTetherCircleRippleTRM LabsWorld Liberty FinancialEllipticUSSSIRS-CI
Countries
North KoreaUnited States

Coverage

oldest first · one row per article · UTC
  1. · 12d ago Cyber Security NewsFirst report

    TRM ties $6.36 billion Binance theft to TraderTraitor

    Sweeper contracts and EIP-7702 delegations drained hot wallets; about $2.7 billion was later frozen.

  2. · 12d ago BleepingComputer

    Binance links $6.3 billion crypto theft to compromised laptop

    TRM and Chainalysis attribute the October 29 theft to North Korea’s TraderTraitor; Binance has not named a culprit.