U.S. authorities have formally identified the Pyongyang regime as responsible for the intrusion into the Binance platform that occurred on October 29, 2026. According to sources on the incident, the total amount stolen is between 6.3 billion dollars, based on data collected by The Verge from the FBI statement, and 6.43 billion dollars, according to information published by The Hacker News. The operation surpasses the 1.46 billion dollars stolen from Bybit in February 2025 and stands as the largest attack against a digital asset exchange.
The federal agency identified the perpetrators as TraderTraitor, a designation used by U.S. authorities for this group, which the cybersecurity industry also tracks as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, or UNC4899. The investigation, conducted jointly by the FBI, the United States Secret Service (USSS), and the Internal Revenue Service Criminal Investigation (IRS-CI) division, confirmed that the attackers began converting most of the stolen funds into Ethereum to then disperse them across decentralized finance services and instant exchange tools.
Scope of the attack and asset blocking
The loot was extracted through 11 different blockchains. 82% of the stolen funds originally corresponded to assets hosted on the Bitcoin and Ethereum networks. According to data provided by blockchain analytics firm Elliptic, groups associated with the Democratic People's Republic of Korea had accumulated more than 6.5 billion dollars in crypto assets in recent years, meaning this single intrusion practically doubles the total balance attributed to the regime.
Despite the magnitude of the diversion, collaboration between issuers and networks helped contain part of the initial impact. Of the 6.43 billion dollars compromised, the companies and foundations managing Tether, Circle, Ripple, Arbitrum, and Optimism applied direct blocks on the involved addresses, immobilizing 2.85 billion dollars in tokens on the chains themselves. For his part, the CEO of Binance stated on October 31, 2026, that 90% of the stolen assets had already been replenished.
The technical vector of TraderTraitor
TraderTraitor has maintained continuous activity in the decentralized applications sector since at least 2020, accumulating a history of attacks against platforms such as DMM Bitcoin, Bybit, KelpDAO, and Bitget. Previous technical investigations by security firms such as SentinelOne, Zscaler ThreatLabz, and Microsoft indicate that the cell uses trojanized modules of Terraform, an infrastructure-as-code tool that allows for defining and provisioning cloud resources through readable configuration files.
Through these modified providers, the attackers distribute a Bash executable that selects and downloads specific components for the victim's operating system, whether macOS, Linux, or Windows. Documented tools include FLATROOF, an implant designed to steal credentials and confidential data via Python scripts, and the ROOFDECK backdoor, which grants operators persistent remote access to the compromised infrastructure.
Social engineering supported by artificial intelligence
Initial access to corporate environments was not based solely on software vulnerabilities, but on coordinated social engineering campaigns. Microsoft reports detail that the group used highly specific job recruitment lures, targeting developers and engineers at firms linked to artificial intelligence, cybersecurity, and blockchain technology.
To give credibility to the fake job proposals, the attackers operated shell companies and created fictitious profiles on professional networks, relying on generative artificial intelligence tools to draft personalized offers and schedule simulated technical interviews. Once the professional's trust was gained, the lure culminated in the sending of code projects or technical tests containing the malicious dependencies responsible for deploying the payload on corporate machines.
After preemptively pausing withdrawal operations at the time of the compromise, Binance resumed the first phase of fund withdrawals on November 1, 2026, between 6:00 and 9:00 UTC, while keeping deposits operational. The sector's attention is now focused on the ability of authorities and exchanges to track the wallets flagged by the FBI and intercept the remaining funds before their mixing and fragmentation process concludes.
