Unmasking the Crypto Hackers Behind Binance’s $6.3B Breach
What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist?
The FBI has attributed the theft of more than $6.3 billion in digital assets from Binance to TraderTraitor, a North Korea-aligned hacking group with a long track record of targeting cryptocurrency firms. The incident is being described as the largest cryptocurrency heist on record.
In a security alert published Saturday, the agency said TraderTraitor was responsible for the attack. The group is also tracked by security researchers under several other names, including Lazarus Group, APT38, Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
According to the information cited, most of the funds were taken in a short window of time. Binance later reopened withdrawals and said it had replaced the vast majority of the stolen assets with its own funds. Even so, the breach triggered significant customer withdrawals in the hours that followed.
TraderTraitor is the name assigned to a North Korean cluster known for orchestrating cryptocurrency thefts against the Web3 industry by tricking victims into downloading malware-laced applications. The group has been active since at least 2020, and is known for using convincing lures, fake personas, and techniques designed to evade detection.
The Binance incident matters beyond its size because it underscores a persistent risk for the crypto sector: well-resourced threat actors continuing to target exchanges, protocols, and employees as a pathway to large-scale theft.
North Korean hackers linked to TraderTraitor have been connected to multiple high-profile crypto thefts in recent years, including:
- $387.5 million Bitget theft (September 2026)
- $280 million Drift hack (April 2026)
- $1.5 billion Bybit heist (February 2025)
- $308 million DMM Bitcoin theft (May 2024)
The FBI’s attribution adds official weight to earlier analyst suspicions and places the Binance breach in a broader pattern: repeated, large-scale cryptocurrency thefts tied to a single North Korea-aligned ecosystem of operators and tooling.
