FBI links $6.3 billion Binance crypto heist to North Korean hackers

What it is

On Saturday (31 October 2026) the FBI published an alert attributing the theft of about $6.36 billion from Binance on or about 29 October 2026 to North Korea's TraderTraitor (also tracked as Lazarus Group, Jade Sleet and APT38). TRM Labs and Chainalysis had already linked the theft to the group. The FBI, U.S. Secret Service and IRS Criminal Investigation are asking exchanges, blockchain operators and other virtual asset service providers to block transactions tied to the listed addresses.

How it works

Binance traced the breach to a compromised DevOps engineer's laptop. That gave the attackers access to a service container, from which they submitted unauthorized withdrawals across ten blockchains. Most of the funds moved within 20 minutes.

The page ties this to earlier TraderTraitor intrusions that also began with a person who had access to crypto infrastructure:

• DMM Bitcoin (May 2024, $308 million): a fake LinkedIn recruiter had a Ginco employee run malicious Python code disguised as a pre-employment test.
• Bybit (February 2025, $1.5 billion): a compromised Safe{Wallet} developer machine let the attackers manipulate a legitimate transaction request.
• Drift (April 2026, $280 million): a six-month operation in which people posing as a trading firm met contributors at industry conferences. Devices are believed to have been compromised through a malicious code repository or a TestFlight application.
• Bitget (September 2026, $387.5 million): listed by the FBI, with no mechanism given.

"Operation DreamJob" is the long-running Lazarus campaign of fake recruiter approaches to developers and crypto staff.

What to do

• Load the FBI's 628 addresses into transaction screening and blocking: 608 Ethereum, 19 Bitcoin and one Solana. The addresses are in the FBI alert, not on the BleepingComputer page.
• Expect laundering mainly through ETH, then DeFi platforms and instant swap services. The FBI says this is where it has seen the group converting assets and where it expects further movement.
• Treat engineers with access to signing, withdrawal or wallet infrastructure as the target. The page does not list specific controls, but each case above began with a developer or employee endpoint.

Caveats

The page gives no initial access vector for the Binance laptop compromise, so a link to DreamJob-style lures is not established for this case. Binance's status as of 1 November 2026:

• About 95% of the impacted amount is covered, up from 90%.
• The remaining 5% is less-liquid tokens still being bought on the market and over the counter.
• The first phase of withdrawals is due to resume on 1 November between 06:00 and 09:00 UTC.
• Deposits are unaffected.
• BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC balances are stated to be fully backed.
• Binance says it will absorb the loss and not pass it to users.