The FBI has formally attributed the theft of about $6.3 billion in cryptocurrency from Binance to TraderTraitor, a North Korean state-backed group also tracked as Lazarus Group, Jade Sleet and APT38. According to BleepingComputer, the agency published its alert on 31 October, saying the theft took place on or about 29 October. It is the largest cryptocurrency heist on record.
For people who build software, the most important detail is how the attackers got in. Binance has linked the breach to a compromised laptop belonging to one of its DevOps engineers. That fits a pattern in North Korea's biggest thefts: the way in is a developer's or employee's computer, not the exchange's wallets.
What happened
Binance says the compromised laptop gave the attackers access to a service container, from which they submitted withdrawal transactions that were never authorized. BleepingComputer reports that roughly $6.36 billion left the exchange across ten blockchains, and that most of it moved within about 20 minutes. Help Net Security notes that Binance found no evidence that a wallet private key had leaked, and that the company plans a technical post-mortem once its investigation is finished.
The FBI's attribution confirms what blockchain analysis firms TRM Labs and Chainalysis had already said. The agency reports that TraderTraitor has been converting the stolen funds mostly into Ethereum, and expects them to be laundered further through decentralized finance platforms and instant swap services. Together with the Secret Service and IRS Criminal Investigation, it has asked exchanges and other virtual asset providers to block transactions tied to the attackers, and it has published 628 addresses: 608 on Ethereum, 19 on Bitcoin and one on Solana.
The developer laptop keeps being the way in
BleepingComputer lists a string of earlier thefts it ties to North Korean hackers, including $387.5 million from Bitget in September 2026, $280 million from Drift in April 2026, $1.5 billion from Bybit in February 2025 and $308 million from DMM Bitcoin in May 2024. Several of them started on a person's machine rather than in production systems.
In the DMM case, an attacker posing as a recruiter on LinkedIn persuaded an employee at wallet company Ginco to run malicious Python code presented as a pre-employment test. Bybit's loss traced back to the compromised computer of a Safe{Wallet} developer, which let the attackers tamper with a legitimate transaction request and send the funds to their own wallets. The Drift attack involved six months of relationship building, with people posing as a trading firm meeting Drift contributors at industry conferences; the devices are believed to have been compromised through a malicious code repository or a TestFlight app.
The recruiter approach has a name, Operation DreamJob: fake job offers sent to software developers and crypto staff to get them to install malware. The lesson reaches beyond crypto. Any engineer whose laptop can reach deployment tooling, containers or signing infrastructure is a target worth months of patience to a well-funded group.
Where Binance stands
Binance told BleepingComputer it planned to restart the first phase of withdrawals on 1 November, between 06:00 and 09:00 UTC. It says it has now covered about 95% of the stolen amount, up from 90% in its previous update, and is buying the remaining less-liquid tokens through market and over-the-counter channels. The exchange says balances in major assets including BTC, ETH, USDT, BNB, SOL and USDC are fully backed, that deposits were not affected, and that users will not bear the losses.
What to do
- Treat unsolicited job offers that ask you to run code, clone a repository or install an app as a likely attack, especially if you hold access to production or financial systems.
- Review which engineers' laptops can reach deployment pipelines, service containers or transaction tooling, and narrow that access where you can.
- If you run an exchange or other virtual asset service, block transactions linked to the 628 addresses the FBI published.