Ing. Calogero Bono
The FBI has formally attributed to TraderTraitor, a hacking group linked to North Korea, the theft of over $6 billion in digital assets from Binance. According to the source, it is the largest cryptocurrency theft in history, more than four times the Bybit hack of February 2025. Binance has meanwhile begun gradually reopening withdrawals. It matters even if you don't use crypto, because attackers often target people rather than technology.
A few terms before we get into the facts. TraderTraitor is the name given to a North Korean group active since at least 2020, also known as Jade Sleet or UNC4899. DeFi refers to decentralized financial services, used to mix funds. Terraform provider is a component developers use to manage cloud infrastructure. Backdoor is a hidden access point that gives remote control of a computer. On-chain freezing is the blocking of funds by issuers or networks.
What did the FBI determine about the Binance theft?
According to The Hacker News, the FBI, together with the U.S. Secret Service and IRS Criminal Investigation, observed the group converting the stolen funds mainly into Ethereum. The agency expects the funds to then pass through DeFi and instant-exchange services, in preparation for further laundering stages.
The FBI also published a list of wallet addresses the attackers are reportedly using. The haul exceeds the $1.46 billion taken from Bybit. It was stolen across 11 blockchains, 82% on Ethereum and Bitcoin.
We had already covered the first details in the article Binance, 6.3 billion stolen in 20 minutes.
How much was stolen and how much has been frozen?
Figures vary depending on the source. The FBI, according to The Hacker News, cites $6.43 billion. The Verge reports $6.3 billion and TechRadar $6.36 billion, taken in about 20 minutes.
Of the $6.43 billion, $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. This calculation is ours, but it amounts to about 44% of the total.
According to the analytics firm Elliptic, the episode nearly doubles what the North Korean regime has stolen. Thefts attributed to North Korea-linked actors would exceed $6.5 billion in recent years.
Will Binance users get their money back?
Binance states it will fully cover the financial impact. According to The Verge, the CEO says 90% of the funds has been reimbursed. The remaining 10% concerns "less liquid" tokens, which may take longer.
Nigel Green, CEO of deVere Group, observes that the emergency fund is about $1.2 billion and the gap is much larger. The rest should therefore come from the company's balance sheet.
On withdrawals, Binance has announced the resumption of the first phase, between 6 and 9 UTC. Deposits, it clarifies, remained open and were not affected.
How TraderTraitor operates and what it means for developers
The group deceives victims with infected applications. According to reports from SentinelOne, Zscaler and Microsoft cited by the source, it uses tampered Terraform providers as a distribution vehicle. A Bash loader selects the malware suited to the operating system, up to the ROOFDECK backdoor.
The pretext is fake job offers. Microsoft describes recruiters from a fake AI-based blockchain intelligence company, who contact software engineers and schedule interviews. AI is also used to create lures and fake profiles.
On how it got into Binance, TechRadar reports that a compromised employee laptop was an initial hypothesis, but the story appears broader. Researcher Pieter Arntz of Malwarebytes says it is necessary to understand which defenses failed to stop the unauthorized transactions.
The same upstream attack dynamic appears in our analysis of hackers using AI to steal accounts.
Limits to know
It is not clear how the attackers reached Binance's withdrawal systems, and the compromised laptop lead is only an initial hypothesis. Figures differ between sources. It is not verified that the Terraform provider method was used against Binance specifically; the source links it to the group in general. We don't know how much of the funds will be recovered, nor when withdrawals will fully resume.
What changes for those working with digital tools
If you develop or manage infrastructure, the components you install should be treated as code to verify, even when they come from a familiar workflow. Check the origin of Terraform providers and dependencies. Be wary of recruiters who ask you to run code during an interview. For a company with its own servers, updates and continuous monitoring matter more than perimeter protection alone, as Ben Bernstein of Huntress reminds us, who advises assuming someone will eventually get in. Finally, watch out for messages exploiting the Binance case for phishing.
Our take
The most uncomfortable fact is that a giant with sophisticated defenses was beaten in about 20 minutes after days of preparation. Binance's statement on reimbursements reassures customers, but it does not answer the central question, namely which controls failed. Until Binance explains this, the promise of transparency remains incomplete. For businesses the lesson is not about crypto. The target is people and everyday work tools, and technical security alone is not enough.
Frequently asked questions
Who is TraderTraitor?
It is a hacking group aligned with North Korea, active since at least 2020. According to the source it is also known as Jade Sleet and UNC4899, and has already been linked to attacks on DMM Bitcoin, Bybit, KelpDAO and Bitget.
How much was stolen from Binance?
It depends on the source. The FBI, according to The Hacker News, cites $6.43 billion, while The Verge reports $6.3 billion and TechRadar $6.36 billion.
Have the funds been recovered?
Partly. Tether, Circle, Ripple, Arbitrum and Optimism have frozen $2.85 billion. Binance also states it has reimbursed 90% of the funds for customers.
Have withdrawals on Binance resumed?
Yes, gradually. Binance reopened the first phase of withdrawals between 6 and 9 UTC, while deposits were never closed.
Do people without crypto face any risk?
The direct risk is small, according to Ben Bernstein of Huntress. However, scams using the case as bait remain possible, so check your account status only through official apps or websites.
What to watch after the FBI attribution
The case is open on several fronts, from investigations to reimbursements. These are the signals to follow in the coming weeks.
- Follow whether Binance publishes a technical account of how the attackers reached its withdrawal systems and new proof of reserves.
- Check whether new funds are frozen or recovered, using the wallet addresses circulated by the FBI.
- Watch whether authorities in the United States, Europe and Asia introduce mandatory security standards for platforms, as Nigel Green suggests.
