FBI Links North Korea’s TraderTraitor to $6.43 Billion Binance Crypto Heist

The US Federal Bureau of Investigation has officially attributed a massive cryptocurrency theft involving approximately $6.43 billion in digital assets to TraderTraitor, a hacking group linked to North Korea.

The group is also tracked by cybersecurity researchers under several other names, including Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.

According to the FBI, the attackers stole cryptocurrency connected to Binance and subsequently began moving the funds through different blockchain networks. Investigators observed that much of the stolen cryptocurrency was being converted into Ethereum.

Authorities warned that the stolen assets could be moved through decentralized finance platforms and instant cryptocurrency exchange services to make financial tracking and recovery more difficult.

The FBI, US Secret Service, and Internal Revenue Service Criminal Investigation division are working together to investigate the incident and track the movement of the stolen funds.

Investigators also released cryptocurrency wallet addresses associated with the suspected laundering operation to help identify and monitor transactions.

The scale of the incident makes it one of the largest cryptocurrency thefts ever reported, surpassing the approximately $1.46 billion Bybit hack recorded in February 2025.

Blockchain security researchers reported that the stolen assets were spread across 11 blockchain networks, with approximately 82 percent associated with Ethereum and Bitcoin.

There has also been progress in freezing some of the stolen funds. According to the reported investigation, approximately $2.85 billion worth of assets had been frozen on-chain by companies including Tether, Circle, Ripple, Arbitrum, and Optimism.

Binance temporarily suspended certain withdrawal services following the incident but subsequently began restoring withdrawals in phases after conducting security assessments.

The investigation adds to growing concerns about North Korea-linked cybercriminal operations, which have increasingly targeted cryptocurrency platforms and financial infrastructure to generate funds.