North Korean hacking group TraderTraitor linked to $6.3 billion Binance theft
Cybersecurity firms say the North Korean group TraderTraitor likely carried out the $6.3 billion crypto theft from Binance, with proceeds used to fund the regime's weapons programmes.
Cybersecurity investigators have identified a North Korean hacking group called “TraderTraitor” as the likely perpetrators of the $6.3 billion theft from cryptocurrency exchange Binance, according to statements made on Oct. 30. Blockchain analysis firms TRM Labs and Chainalysis linked the heist to the group, which was previously named in a 2022 joint warning by the FBI, the Cybersecurity and Infrastructure Security Agency and the U.S. Treasury.
The researchers noted that TraderTraitor focuses on financial targets and employs experienced operators from North Korea’s historic APT38 hacking units. The group reportedly tricks developers and IT staff at crypto firms through malware-laden job offers or fake interviews, gaining access to login credentials and enabling unauthorized transfers.
“This group, in particular, are somewhat artists in terms of getting into these distributed finance companies,” said Rafe Pilling, senior director of threat research at Sophos.
Chainalysis reported that North Korea stole at least $6.75 billion in cryptocurrency in 2025, including a $1.5 billion hack of the Bybit exchange in February and a $387 million breach of Bitget in September. Michael Barnhart of DTEX said the total amount stolen by the regime now approaches $13.5 billion.
Binance and other exchanges are working to freeze the stolen assets, with about $3 billion reportedly located so far. Barnhart added that after the Bitget incident, “a lot of the community expected something like this.”
The stolen funds are allegedly funneled through Chinese organized-crime money-laundering networks and used to finance North Korea’s nuclear, missile and drone programmes, as well as to support Russia’s war effort. A U.S. State Department spokesperson described North Korean cybercrime as a “global problem” and said cryptocurrency heists have become a significant part of the regime’s strategy to circumvent sanctions.
The FBI has warned that North Korean operatives also take covert jobs at technology and financial firms abroad, earning salaries that are sent back to the government and further supporting its weapons development.