The FBI has attributed the October 29 hack of TraderTraitor to the Lazarus Group, a hacking organization linked to North Korea. This assessment comes from an investigation involving the FBI, the US Secret Service, and blockchain analysts, which concluded that the group played a key role in this cyber incident.
In response, North Korea has rejected these allegations regarding its involvement in the theft of $6.3 billion from Binance, labeling the claims as politically charged. Kim Yo-jong, sister of North Korean leader Kim Jong Un, expressed her country’s frustration over being commonly associated with cybercrimes by the United States, insisting that there is no substantial proof backing these accusations.
She stated, "The US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again. It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds."
In light of the attack, the FBI is advising cryptocurrency exchanges and industry participants to identify and block transactions linked to wallet addresses related to TraderTraitor. Reports indicate the hackers had been targeting Binance employees for months, ultimately breaching an engineer’s laptop which facilitated the withdrawal of funds from the exchange's wallets. They also reportedly used malware and simulated job interviews to extract valuable information from Binance staff.
This incident has reignited discussions about North Korea's suspected role in significant cryptocurrency thefts. TraderTraitor, associated with the Lazarus Group, had previously been implicated by US authorities in a $1.5 billion hack of Bybit in February 2025.
Despite the allegations, North Korea continues to deny any engagement in these cyber activities. Investigations have shown that the country maintains organized cyber operations, often recruiting adept university students who are placed in hacking units controlled by intelligence agencies.
In the aftermath of the hack, Binance has reported significant customer withdrawals, totaling $4.72 billion as trading resumed on Sunday. A spokesperson noted that this amount, while substantial, constitutes a small fraction of Binance's overall assets, estimated to be around $157 billion. The total includes effects from the hack, subsequent withdrawals, and fluctuations in cryptocurrency prices.
The spokesperson remarked, "Withdrawal levels are stabilising to what we would consider normal and expected on-chain activity."
Binance also stated that it would absorb the losses from this breach, having already compensated for about 95% of the stolen assets and is actively working with cryptocurrency issuers to freeze the affected funds.
