FBI Links North Korean Hacking Group to Record Cryptocurrency Theft
The FBI has identified TraderTraitor, a North Korea-aligned hacking group, as responsible for the theft of over $6 billion in cryptocurrency, marking the largest heist in history.
The FBI has officially linked the theft of more than $6 billion in virtual assets to TraderTraitor, a hacking group associated with North Korea, also known by various aliases including Jade Sleet and Slow Pisces. The agency, in collaboration with the U.S. Secret Service and the IRS Criminal Investigation, reported that the stolen assets are primarily being converted into Ethereum (ETH) for laundering purposes.
In a statement, the FBI noted, "It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages." The FBI has released a list of wallet addresses used by the attackers to facilitate this laundering.
This incident has prompted Binance to resume withdrawals after a temporary pause, stating that it has implemented precautionary measures to enhance platform security. Binance emphasized its commitment to progressively restore services while ensuring the safety of its users.
The theft surpasses the previous record of $1.46 billion stolen from Bybit in February 2025, making it the largest cryptocurrency heist to date. Blockchain analysis firm Elliptic reported that North Korean actors have stolen over $6.5 billion in cryptoassets in recent years, with TraderTraitor's recent haul accounting for a significant portion of this total.
Of the $6.43 billion stolen, approximately $2.85 billion has been frozen on-chain by various cryptocurrency platforms. TraderTraitor has been involved in multiple cryptocurrency thefts since at least 2020, employing tactics such as malware-laced applications to deceive victims.
Recent reports indicate that TraderTraitor is refining its methods, using trojanized Terraform providers to distribute malware and employing social engineering tactics to target individuals in cybersecurity and blockchain sectors. Microsoft highlighted that the group has utilized tailored domains and social media profiles to pose as recruiters, leveraging AI to create convincing lures for potential victims.