Binance was hit by the Binance Crypto Heist, where a compromised DevOps laptop allowed TraderTraitor to access a service container and execute unauthorized withdrawals totaling a confirmed $6.3 billion, reported by 4 outlets: Bleeping Computer, DecryptCO, Hackread, and The Hacker News.
What do we know about the Binance Crypto Heist incident?
According to Bleeping Computer, the FBI attributes the $6.3 billion Binance Crypto Heist to TraderTraitor, a North Korea threat group also known as Lazarus Group and APT38, detailed in the Proactive Cyber Operations Threat Briefing. TraderTraitor compromised a DevOps laptop. This access allowed TraderTraitor to breach a service container and submit unauthorized withdrawal transactions. TraderTraitor executed these unauthorized withdrawals across 10 blockchains in roughly 20 minutes. TraderTraitor converted most of the stolen funds to ETH. TraderTraitor then laundered the cryptocurrency through DeFi platforms and instant-swap services. The FBI, USSS, and IRS-CI published 628 addresses tied to the theft, specifically noting 608 ETH, 19 BTC, and 1 SOL. The federal agencies urged cryptocurrency exchanges to block laundering attempts tied to these specific addresses. Binance recovered about 95% of the assets and stated it will bear the financial losses. Binance resumed withdrawals within a specified window. Binance notes that balances for BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC remain fully backed as the company continues strengthening safeguards.
According to Hackread, the FBI, USSS, and IRS-CI announced their formal attribution on Oct. 31, 2026. The agencies linked the $6.3 billion breach to TraderTraitor and published the same 628 crypto addresses, listing 608 Ethereum, 19 Bitcoin, and 1 Solana. Forensics show TraderTraitor converted the bulk of the loot to Ethereum. TraderTraitor planned further laundering through DeFi and instant-exchange services. The compromised laptop belonged to a DevOps engineer. Binance confirmed that no private keys leaked during the service container access and unauthorized withdrawals. Authorities and industry players have frozen about $3B of the stolen funds so far. Binance indicated that a technical report on the Binance Crypto Heist is forthcoming.
What do several outlets confirm, and what does only one report?
Bleeping Computer and Hackread both report the stolen amount as roughly $6.3 billion and confirm the distribution of 628 addresses. According to The Hacker News, the FBI, US Secret Service, and IRS-CI formally attribute a record $6.43 billion Binance Crypto Heist to TraderTraitor. The outlet alone lists TraderTraitor aliases Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The theft spanned 11 blockchains, with 82% of the stolen assets located on Ethereum and Bitcoin. TraderTraitor converted the assets primarily into Ethereum. TraderTraitor slated the funds for further laundering via DeFi and instant-swap services. Tether, Circle, Ripple, Arbitrum, and Optimism have frozen about $2.85 billion on-chain. Binance initiated resumed phased withdrawals. TraderTraitor used trojanized Terraform providers delivering a Bash loader. The Bash loader downloads a cross-platform FLATROOF information stealer and a ROOFDECK backdoor. TraderTraitor paired these tools with AI-assisted social engineering. TraderTraitor used recruitment-themed, domain-trusted disguises to lure targets. The FLATROOF and ROOFDECK malware enabled persistence across macOS, Linux, and Windows environments.
According to DecryptCO, the record Binance Crypto Heist spooked Bitcoin ETF investors into exits. The incident forced fund managers to redeem or hedge BTC exposure. Counterparty and custody risk came under sharper scrutiny following the breach. Technical analyses flag potential ETF liquidity strains and a higher correlation with spot BTC. The attack prompted a shift toward fortified custody. Administrators moved to cold storage, multi-signature wallets, and MPC wallets to mitigate future exchange compromises. Firms adopt transparent proof-of-reserves to restore investor confidence.
What should defenders check after the Binance Crypto Heist incident?
Scan macOS, Linux, and Windows environments for the FLATROOF information stealer and ROOFDECK backdoor. Examine Terraform providers for trojanized modifications delivering a Bash loader. Block cryptocurrency transfers involving the 628 addresses published by the FBI, USSS, and IRS-CI. Implement cold storage, multi-signature, and MPC wallets to secure digital assets against exchange compromises. Publish transparent proof-of-reserves to document holdings and mitigate future counterparty risks.
BUGSY continuously monitors underground forums for compromised DevOps credentials and threat actor infrastructure to provide actionable intelligence on incidents like the Binance Crypto Heist through our dark web monitoring solutions.
