Update: The FBI Officially Pins the $6.3 Billion Binance Heist on North Korea

An update to my Binance theft post.

What’s new

In a Saturday alert, the FBI confirmed that North Korea’s TraderTraitor (also tracked as Lazarus, Jade Sleet and APT38) stole more than $6 billion from Binance on or about October 29, BleepingComputer reports. That makes official what TRM Labs and Chainalysis had already said.

• The FBI sees the stolen funds being converted mostly to Ethereum, and expects laundering through DeFi and instant swap services
• The FBI, Secret Service and IRS-CI are asking exchanges and other crypto services to block transactions tied to the laundering addresses
• The FBI published 628 addresses: 608 Ethereum, 19 Bitcoin and one Solana

Recap: Binance traced it to a compromised DevOps engineer’s laptop, and about $6.36 billion moved across ten chains, mostly in 20 minutes.

My take

Same lesson as before: one admin workstation should never be enough to move that kind of money. Separate admin machines, hardware keys, and a human approval step for big withdrawals.

God Bless, and Happy hacking!

References & Further Reading

• FBI links $6.3 billion Binance crypto heist to North Korean hackers (BleepingComputer)
• Binance Ties a $6.3 Billion Crypto Theft to One Compromised DevOps Laptop (EtherNinja)