FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.

The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).

"It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages," the FBI said in a statement.

The agency has also provided a list of wallet addresses that the attackers are said to be using to launder the stolen assets.

The development comes as Binance said it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident.

"Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services," Binance said in a statement.

"We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident."

The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.

"This single incident almost doubles the total cryptoassets stolen by the regime," blockchain analysis firm Elliptic said. "Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen over $6.5 billion in cryptoassets in recent years."

Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.

TraderTraitor is the name assigned to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading malware-laced applications. The cluster is known to be active since at least 2020.