The FBI has attributed the October 29 hacking of TraderTraitor to the Lazarus Group, a North Korean cybercrime organization. This finding comes from a collaborative investigation involving the FBI, the US Secret Service, and analysts from the blockchain sector. In response, North Korea has strongly denied any involvement in the alleged theft of $6.3 billion from the cryptocurrency exchange Binance, labeling the accusations as politically motivated. Kim Yo-jong, sister of North Korean leader Kim Jong Un, spoke out on Tuesday, claiming the United States frequently accuses their nation of cyber offenses without justification.
Kim articulated her concerns, stating, "The US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again. It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds."
The FBI has urged cryptocurrency exchanges and other stakeholders to identify and block transactions related to wallet addresses connected to the TraderTraitor hack. Reports indicate that the hackers had spent months trying to breach Binance's internal systems, ultimately compromising an engineer's laptop. This breach enabled the hackers to withdraw funds from Binance's wallets. Additionally, the attackers employed malware and organized fake job interviews with Binance employees to extract sensitive information.
This hack reignites concerns regarding North Korea's suspected role in significant cryptocurrency thefts. The Lazarus Group had previously been tied by US authorities to the $1.5 billion hack of Bybit in February 2025.
Continuing to deny its involvement in such cyber incidents, North Korea has been reported to have established organized cyber operations that recruit technologically skilled university students into hacking units supervised by their intelligence services.
In the aftermath of the hacking incident, Binance has seen an increased volume of withdrawals from its platform. A spokesperson disclosed to the BBC that net withdrawals reached $4.72 billion after trading resumed on Sunday. This figure, while significant, represents a small fraction of Binance's total estimated assets, which are about $157 billion. The reported withdrawals reflect a combination of the hack’s impact, subsequent withdrawals, and movements in cryptocurrency prices.
The spokesperson further noted, "Withdrawal levels are stabilizing to what we would consider normal and expected on-chain activity." Additionally, Binance assured its customers that they have covered approximately 95% of the losses from the incident and are actively collaborating with cryptocurrency issuers to freeze the affected assets.
