Who Hacked Binance? FBI Names North Korea's TraderTraitor

When we first reported the Binance hack on the night of 29 October 2026, nobody knew who did it or how. Three days later two answers are official. On 31 October the FBI named North Korea, a group it calls TraderTraitor. And Binance says the way in started with a DevOps engineer’s laptop.

A third answer spread faster than both: that the engineer was seduced by a North Korean agent. Binance says that story is false. This piece separates what is confirmed, what is claimed and what is rumour, with a source for each.

The short version

Question	Answer	Status
Who did it	North Korea’s TraderTraitor group	Confirmed by the FBI
How much	About $6.3 billion, the largest theft on record	Binance and three tracing firms roughly agree
How they got in	A compromised DevOps engineer’s laptop, then a service container	Binance’s account. Not independently checked
The spy romance	An engineer seduced by a North Korean operative	Denied by Binance as “completely false”
Frozen or seized	About $2.85 billion	Elliptic’s count
Users	Withdrawals back from 1 November, 95% of the loss covered	Binance’s statement

How the attribution came together

The theft began at about 20:05 UTC on 29 October. According to the tracing firm TRM Labs, most of it was done in about 20 minutes. The attribution took less than two days.

When	What happened
29 Oct, late	TRM Labs says North Korea is behind it “with high confidence”, AP reports
30 Oct, 00:30 ET	Chainalysis attributes the attack to TraderTraitor
30 Oct	Investigator ZachXBT reports that funds from Binance and from the September Bitget theft met at the same address, and that “the same actor is likely behind both incidents”
31 Oct	The FBI publishes an alert: “North Korea Responsible for $6 Billion+ Binance Attack”
1 Nov	Binance reopens withdrawals. A romance story goes viral and is denied the same afternoon

The FBI says it is working with the Secret Service and IRS Criminal Investigation, and that the attackers are converting much of the haul to ETH. It published the addresses it links to the theft and asked exchanges, bridges and DeFi services to block them. CoinDesk counted more than 600 Ethereum addresses, just under 20 Bitcoin addresses and one on Solana.

Why investigators point at North Korea

Attribution in crypto rests on habits, not confessions. The tracing firms list several that match earlier TraderTraitor cases:

Speed over price. Chainalysis says the attackers swapped about $325 million in stablecoins for about $285 million in ETH. Losing $40 million was worth it to get out before issuers could freeze the coins.
A shared route. Elliptic found the Binance funds laundered alongside the Bitget funds, and through services also used after the BigONE, WOO X and AFX thefts.
Small signatures. Chainalysis notes many laundering addresses first receive exactly 1 TRX, which helps link them together.
A machine that does not sleep. Elliptic counted 1,113 transfers on Tron with a median gap of 90 seconds. The laundering ran straight through both nights in Pyongyang, which points to automation.

Who TraderTraitor is

TraderTraitor is a North Korean unit that security firms also track as Jade Sleet, UNC4899 and Slow Pisces. Its method has not changed much in four years: it goes after the people who hold access, not the code.

2022. The US cyber agency CISA warned that the group sends crypto company staff fake job offers, often aimed at system administrators and DevOps engineers, with booby-trapped apps.
May 2024, DMM Bitcoin, $308 million. The FBI and Japanese police say a fake LinkedIn recruiter sent an engineer at a partner company a “pre-employment test” on GitHub. The code gave the attackers his session, and from there the wallet system.
February 2025, Bybit, about $1.5 billion. A developer machine at the wallet provider Safe{Wallet} was compromised. Until 29 October that was the largest theft on record.
September 2026, Bitget, $387.5 million. Bitget says its back-end wallet system was breached and transaction data spoofed. Chainalysis tied it to North Korea.

Elliptic notes that before Bybit, the biggest single theft of any kind was the roughly $1 billion Saddam Hussein’s regime took from Iraq’s central bank in 2003. The Binance theft is more than six times that.

What Binance says happened

Binance’s explanation, quoted by BleepingComputer:

The incident may involve a compromised DevOps engineer’s laptop, which allowed an attacker to gain access to a service container and submit unauthorized withdrawal transactions.
Binance statement, 29 and 30 October

Binance adds that it has “no evidence of any wallet private key leak”. Co-CEO Richard Teng then pushed back on the idea that one person caused it. The attacker “did not simply use one engineer’s permissions”, he said, it was not a single “one-click” action, and Binance “has not attributed responsibility to any individual”.

In a video on 30 October, reported by CoinDesk, Teng said the investigation had found more points of breach, that a self-destruct mechanism had erased evidence, and that the EIP-7702 authorizations “did not pass through our normal approval controls”.

That fits what the chain shows. Our first report quoted a researcher who said either a stolen key or a malicious signed authorization would explain the drain. Elliptic’s later analysis settles it: at 20:20 UTC one transaction carried 50 authorizations validly signed with the key of the wallet known as Binance 14, and Binance 16 sent 28,006 ETH signed with its own key. Together with Binance’s statement, that suggests the keys never left Binance. The attacker got Binance’s own systems to sign for him.

It was planned. Elliptic says the attacker’s wallet was funded through Tornado Cash with three payments of 0.1 ETH, and the sweeping contract was deployed at 15:59 UTC and rehearsed on another wallet about four hours before it was used on Binance.

The spy romance story

On 1 November at 14:03 UTC, the news account AlphaWire posted what it called “new, unverified allegations”: that the DevOps engineer had a romantic relationship with a North Korean operative and left the laptop unattended. It credited the claim to ZachXBT. Other accounts on X repeated it, and it spread within hours.

At 16:58 UTC Binance co-CEO Yi He replied in Chinese. In translation: “This story is more dramatic, but it is not true. ZachXBT did not say that.” Binance told The Crypto Times the claim is “completely false”.

What ZachXBT actually posted on 30 October was about money, not people: Binance and Bitget funds, about $388 million from Bitget, met at the same address after passing through THORChain. No source we found, official or on-chain, mentions a relationship of any kind.

The story caught on because it sounds like something North Korea would do, and in a way the group does do it. Its documented method is to win an employee’s trust: a recruiter, a job offer, a coding test. A romance has not been shown in this case. Until someone publishes evidence, treat it as fiction.

Where the money is now

Elliptic’s count as of its latest update:

Stolen	About $6.43 billion across about 11 blockchains. Binance’s own figure is about $6.3 billion
Frozen or seized	About $2.85 billion, 44% of the total, almost all of it USDT and USDC
Fastest freeze	Tether froze 1.18 billion USDT 37 minutes after it arrived
Out of reach	About $3.25 billion in coins nobody can freeze: around 584,000 ETH, 18,327 BTC and 233 million XRP, spread over 800+ addresses

The split is the main lesson. Stablecoins have an issuer that can freeze an address, and most of them were stopped. ETH, BTC and XRP have no issuer, and almost all of them got away. Elliptic has published a free list of more than 8,000 linked addresses so other services can screen for them.

Who pays for it

Binance says users will not lose money. In its recovery update of 1 November, it said it had covered 95% of the loss, up from 80% and then 90% earlier, using its SAFU emergency fund, the futures insurance fund and the company treasury. Withdrawals reopened in phases from 06:00 UTC on 1 November across 15 networks. Binance promised a zero-knowledge proof of reserves for 3 November.

Users tested it. Reuters reported net outflows of $3.64 billion by 15:30 GMT on 1 November, about 2.1% of the assets on the exchange. That is a lot of money, and still nothing like a bank run.

One detail does not fit Binance’s framing that only its own hot wallets were hit. CoinDesk found that the drained wallets were previously listed among the assets backing customer balances in Binance’s proof of reserves. Binance has not addressed that directly.

What we still do not know

How the laptop was compromised: a fake job offer, a poisoned app, or something else.
What the other points of breach were, and how long the attacker was inside.
Whether anyone at Binance acted on purpose. Binance says it has not blamed any individual.
How much of the frozen $2.85 billion goes back to Binance, and how fast.
Whether the 3 November proof of reserves shows every customer balance fully backed.

A full post-mortem from Binance would answer most of these. It has not published one yet.

What it means if you play at crypto casinos

The practical advice from our first report still holds: cash out only on networks Binance shows as open, and do not let a casino blame Binance for a delay, because it pays from its own wallets. Two new points:

Do not buy cheap crypto from strangers this month. Exchanges and other crypto businesses that screen deposits will flag coins that trace back to the FBI and Elliptic lists, and can freeze them. A discounted deal on Telegram could be stolen coins, and the freeze lands on you.
Know what your stablecoin can do. Tether froze more than a billion dollars in minutes. That helped here. The same power applies to every USDT and USDC balance. We explain what it means for casino payouts on our Tether and USD Coin pages.

An exchange is a place to change money, not to keep it, and the same goes for a casino. Send winnings to a wallet you control. Our timed cash-outs are in the lab, and if a casino holds your withdrawal and blames the hack, tell us.

FAQ

Q01Who hacked Binance?

The FBI says North Korea is responsible, through a group it calls TraderTraitor, also tracked as Jade Sleet, UNC4899 and Slow Pisces. Chainalysis and TRM Labs reached the same conclusion before the FBI alert of 31 October 2026.

Q02How much was stolen from Binance?

About $6.3 billion by Binance’s count. Elliptic puts it at $6.43 billion across about 11 blockchains. It is the largest theft on record. Around $2.85 billion has been frozen or seized, mostly stablecoins.

Q03How did hackers get into Binance?

Binance says the incident may involve a compromised DevOps engineer’s laptop, which gave the attacker access to a service container used to submit withdrawals. It says no private key leaked and the attack had several points of breach. It has not published a full post-mortem.

Q04Was the Binance hack caused by a North Korean spy romance?

There is no evidence of that. The claim spread on X on 1 November and was credited to ZachXBT, but Binance co-CEO Yi He said it is not true and that ZachXBT did not say it. Binance called it completely false.

Q05Did Binance users lose money?

Binance says no. It says it has covered 95% of the loss from its SAFU fund, futures insurance fund and treasury, and reopened withdrawals from 1 November. It has promised a proof of reserves on 3 November.

Q06Is the Binance hack linked to the Bitget hack?

Investigators think so. ZachXBT and Elliptic found funds from both thefts at the same addresses, and Chainalysis tied the September 2026 Bitget theft of $387.5 million to North Korea as well.

Who Hacked Binance? North Korea, a DevOps Laptop and the Spy Romance Rumour