FBI Blames North Korea's TraderTraitor for $6.3 Billion Binance Theft
Binance disclosed about 6.3 billion US dollars (roughly 980 billion yen) stolen from the exchange as of the morning of October 30, 2026. The FBI later named North Korea's TraderTraitor, a unit tied to the Lazarus group, as the perpetrator.
1 source Nov 2
Reporting from 1 source: ASCII.jp.
Why it matters
The FBI tying the Binance theft to the same TraderTraitor unit that Japanese and US authorities named in the DMM Bitcoin case puts the two incidents on one known playbook: recruiters approaching employees on LinkedIn and handing them a coding test loaded with malicious code.
Key Facts
- Binance disclosed about 6.3 billion US dollars (roughly 980 billion yen) in stolen cryptocurrency on October 30, 2026.
- The FBI named North Korea's TraderTraitor as the perpetrator of the Binance theft.
- Bitcoin, Ethereum and stablecoins were among the assets stolen from Binance.
- The FBI published related wallet addresses and asked exchanges to block transactions.
- TraderTraitor was also named in the roughly 48.2 billion yen DMM Bitcoin theft, which began with a fake recruiter approaching a Ginco employee on LinkedIn.
Bitcoin, Ethereum and stablecoins were taken, and the FBI said the group is mainly converting the funds into Ethereum while publishing wallet addresses for exchanges to block.
The FBI identified the perpetrator as TraderTraitor, which materials from Japan's National Police Agency and the US Department of Justice describe as part of Lazarus, an outfit inside North Korea's Reconnaissance General Bureau. The names are not used by North Korean authorities; security companies and US authorities coined them.
The route into the DMM Bitcoin case ran through an employee of wallet software provider Ginco. A person posing as a recruiter approached the employee on LinkedIn, sent a hiring test, and had the employee copy a test program to GitHub. The program carried malicious code, and the attackers are believed to have impersonated the employee inside Ginco's systems and altered a legitimate DMM transfer request.
Written with AI by Yomimono from the 1 cited source below, including Japanese-language reporting where cited. See our editorial policy.
Add Yomimono as a preferred source on Google