Ing. Calogero Bono
The FBI has formally attributed the theft of more than $6 billion in digital assets from Binance to TraderTraitor, a hacking group linked to North Korea. According to the source, it is the largest cryptocurrency theft in history, more than four times the Bybit hack of February 2025. Binance has meanwhile begun gradually reopening withdrawals. It matters even if you don't use crypto, because attackers often target people more than technology.
A few terms before we get into the facts. TraderTraitor is the name given to a North Korean group active since at least 2020, also known as Jade Sleet or UNC4899. DeFi refers to decentralized financial services, used to shuffle funds. Terraform provider is a component developers use to manage cloud infrastructure. Backdoor is a hidden access point that gives remote control of a computer. On-chain freezing is the blocking of funds by issuers or networks.
What did the FBI establish about the Binance theft?
According to The Hacker News, the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, observed the group converting the stolen funds mostly into Ethereum. The agency expects the funds to then pass through DeFi and instant-exchange services, in preparation for further laundering stages.
The FBI also published a list of wallet addresses the attackers are reportedly using. The haul exceeds the 1.46 billion taken from Bybit. It was stolen across 11 blockchains, 82% on Ethereum and Bitcoin.
We had already covered the first details in the article Binance, 6.3 billion stolen in 20 minutes.
How much was stolen and how much has been frozen?
Figures vary by source. The FBI, according to The Hacker News, cites 6.43 billion dollars. The Verge reports 6.3 billion and TechRadar 6.36 billion, taken in about 20 minutes.
Of the 6.43 billion, 2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. This calculation is ours, but it is about 44% of the total.
For the analytics firm Elliptic, the episode nearly doubles what the North Korean regime has stolen. Thefts attributed to North Korea-linked actors would exceed 6.5 billion in recent years.
Will Binance users get their money back?
Binance states it will fully cover the financial impact. According to The Verge, the CEO says 90% of the funds have been restored. The remaining 10% concerns "less liquid" tokens, which may take longer.
Nigel Green, CEO of deVere Group, notes that the emergency fund is about 1.2 billion and the gap is much larger. The rest should therefore come from the company's balance sheet.
On withdrawals, Binance announced the resumption of the first phase, between 6 and 9 UTC. Deposits, it specifies, remained open and were not affected.
How does TraderTraitor operate and what do developers have to do with it?
The group deceives victims with infected applications. According to reports from SentinelOne, Zscaler and Microsoft cited by the source, it uses tampered Terraform providers as a distribution vector. A Bash loader selects the malware suited to the operating system, up to the ROOFDECK backdoor.
The pretext is fake job offers. Microsoft describes recruiters from a fictitious AI-based blockchain intelligence company, who contact software engineers and schedule interviews. AI is also used to create lures and fake profiles.
On how it got into Binance, TechRadar reports that a compromised employee laptop was an initial hypothesis, but the story appears broader. Researcher Pieter Arntz of Malwarebytes says it is necessary to understand which defenses failed to stop the unauthorized transactions.
The same upstream attack dynamic appears in our analysis of hackers using AI to steal accounts.
Limits to know
It is unclear how the attackers reached Binance's withdrawal systems, and the compromised laptop lead is only an initial hypothesis. Figures differ between sources. It is not verified that the Terraform provider method was used against Binance specifically, the source links it to the group in general. We do not know how much will be recovered, or when withdrawals will return to full capacity.
What changes for those working digitally
If you develop or manage infrastructure, the components you install should be treated as code to verify, even when they come from a familiar workflow. Check the origin of Terraform providers and dependencies. Be wary of recruiters who ask you to run code during an interview. For a company with its own servers, updates and continuous monitoring matter more than entry protection alone, as Ben Bernstein of Huntress reminds us, who advises assuming someone will eventually get in. Finally, watch out for messages exploiting the Binance case for phishing.
Our take
The most uncomfortable fact is that a giant with sophisticated defenses was beaten in about 20 minutes after days of preparation. The statement on refunds reassures customers, but does not answer the central question, namely which controls failed. Until Binance explains it, the promise of transparency remains incomplete. For businesses the lesson is not about crypto. The target is people and everyday work tools, and technical security alone is not enough.
Frequently asked questions
Who is TraderTraitor?
It is a hacking group aligned with North Korea, active since at least 2020. According to the source it is also known as Jade Sleet and UNC4899, and has already been linked to attacks on DMM Bitcoin, Bybit, KelpDAO and Bitget.
How much was stolen from Binance?
It depends on the source. The FBI, according to The Hacker News, cites 6.43 billion dollars, while The Verge reports 6.3 billion and TechRadar 6.36 billion.
Have the funds been recovered?
Partly. Tether, Circle, Ripple, Arbitrum and Optimism have frozen 2.85 billion. Binance also states it has restored 90% of funds for customers.
Have withdrawals on Binance resumed?
Yes, gradually. Binance reopened the first phase of withdrawals between 6 and 9 UTC, while deposits were never closed.
Do people without crypto risk anything?
The direct risk is small, according to Ben Bernstein of Huntress. There remain possible scams using the case as bait, so check your account status only through official apps or websites.
What to watch after the FBI's attribution
The case is open on several fronts, from investigations to refunds. These are the signals to follow in the coming weeks.
- Follow whether Binance publishes a technical account of how the attackers reached its withdrawal systems and new proof of reserves.
- Check whether new funds are frozen or recovered, using the wallet addresses released by the FBI.
- Watch whether authorities in the United States, Europe and Asia introduce mandatory security standards for platforms, as Nigel Green suggests.
