FBI Attributes Record $6.43 Billion Binance Heist to North Korea-Aligned TraderTraitor

The U.S. Federal Bureau of Investigation (FBI), alongside the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), has officially attributed a cryptocurrency theft exceeding $6.43 billion from the Binance platform to the North Korea-aligned hacking group TraderTraitor. The group is also tracked under multiple aliases, including Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.

The attribution was announced on November 1, 2026, and marks the largest single financial theft attributed to North Korea-linked actors to date. The FBI stated that the theft involved virtual assets held on the Binance platform, though specific details regarding the exploitation vector, timeline of the compromise, or the precise methodology used by the threat actor were not disclosed in the public announcement.

The advisory notes that TraderTraitor is considered an elite actor within the North Korean cyber ecosystem, known for conducting financially motivated operations targeting cryptocurrency platforms, decentralized finance (DeFi) protocols, and individual investors. The group's activities are assessed to support the strategic objectives of the DPRK regime.

The FBI, USSS, and IRS-CI recommended that cryptocurrency exchanges, wallet providers, and investors implement enhanced security controls, including multi-signature wallet architectures, rigorous transaction monitoring, and increased awareness of social engineering and supply chain tactics employed by DPRK-aligned actors. As of the publication of this report, no software patch or vulnerability fix has been identified as the root cause, as the investigation into the specific exploitation method continues. On-chain analysis and Binance's internal forensic review are ongoing to verify the scope and technical details of the breach.