The Federal Bureau of Investigation has linked the theft of more than $6 billion in virtual assets from cryptocurrency firm Binance to TraderTraitor, a North Korea-aligned hacking group also tracked under the names Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899.
The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it had observed the threat actor converting the stolen assets primarily into Ethereum (ETH).
The FBI said it expects the attackers to further launder the assets through decentralized finance (DeFi) platforms and instant-swap services before moving them through additional laundering channels.
The agency also released a list of wallet addresses that the attackers are believed to be using to launder the stolen assets.
READ: DOJ seizes $560,000 in cryptocurrency tied to alleged Hamas fundraising scheme (September 1, 2026)
Binance said Thursday that $6.3 billion in digital assets had been affected by what is believed to be the largest cryptocurrency hack on record. The company said about half of the assets had been frozen, but many remained in the hackers’ possession. It added that it would “cover all losses.”
Binance said it had resumed the first phase of withdrawals, beginning that day between 6 a.m. and 9 a.m. UTC, after pausing them because of the incident.
“Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services,” Binance said in a statement.
The Binance hack surpasses the February 2025 theft of $1.46 billion from Bybit, making it the largest cryptocurrency theft in history. The stolen funds were spread across 11 blockchains, with 82% held on Ethereum and Bitcoin.
READ: Indian national used data of hundreds of thousands of Americans in $227 million Medicare fraud (October 31, 2026)
“This single incident almost doubles the total cryptoassets stolen by the regime,” blockchain analysis firm Elliptic said. “Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen over $6.5 billion in cryptoassets in recent years.”
TraderTraitor is the name given to a North Korean-linked group with a history of targeting the Web3 industry through cryptocurrency thefts. According to The Hacker News, the group has used malware-laced applications to trick victims into downloading malicious software.
The incident involved Binance.com. Binance.US, the smaller crypto platform that provides trading services specifically for U.S. residents, said it was not affected by the hack.
Click Here For The Original Source.
——————————————————–
