The Federal Bureau of Investigation (FBI) has issued an official security advisory confirming that the North Korean hacking group known as TraderTraitor (also known as Lazarus Group and APT38) is responsible for the massive cyberattack that targeted the Binance platform on October 29, 2026, resulting in the theft of $6.36 billion in digital assets.
Details of the Breach and Execution Method
According to the investigation, the breach began through a computer belonging to a DevOps engineer at the platform, which granted the attackers access to a service container that allowed them to execute unauthorized withdrawal transactions. The theft was carried out across ten different blockchains, with most of the funds moved within just 20 minutes.
The FBI has published a list of 628 cryptocurrency addresses associated with the attack, including 608 addresses on the Ethereum network, urging trading platforms and virtual asset service providers to block these addresses to prevent money laundering.
Why This News Matters
This incident represents the largest cryptocurrency theft in recorded history and underscores the persistent advanced threats targeting digital financial infrastructure. These groups frequently rely on social engineering, such as the Operation DreamJob campaign, where attackers pose as recruiters to target developers with malware—a tactic that has proven effective in previous breaches such as DMM and Bybit.
Binance's Stance
For its part, Binance announced that it assumes full financial responsibility for the stolen funds, confirming that it will not pass any losses on to users. The platform stated that it has covered approximately 95% of the affected amount so far and is working to fully restore services, with continued full support for major currency balances such as BTC, ETH, USDT, BNB, and SOL.
This development comes at a time when pressure is mounting on trading platforms to strengthen cybersecurity measures, especially as attackers shift toward decentralized finance (DeFi) platforms and instant swap services to launder stolen assets, making tracking and recovery a complex technical and legal challenge.