Binance crypto heist steals $6.43 billion across 11 chains
The Binance crypto heist took $6.43 billion in virtual assets across 11 blockchains, which are shared digital ledgers used to record transactions. The U.S. Federal Bureau of Investigation (FBI) attributed the theft to TraderTraitor, a North Korea-aligned hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899.
The FBI, the U.S. Secret Service and the Internal Revenue Service Criminal Investigation unit reported observing the group convert stolen assets primarily into ETH, the native asset of the Ethereum network. The FBI expects the assets to move through decentralised finance (DeFi), financial services operated through blockchain-based software, and instant swap services as part of further laundering. It also published wallet addresses, the blockchain account identifiers used to send and receive assets, that investigators associate with the laundering activity.
Binance said it had begun the first phase of restoring withdrawals in a window between 6 a.m. and 9 a.m. UTC after pausing them following the incident. The exchange said its teams had introduced precautionary measures, carried out security assessments and checked whether affected services were ready to return. Withdrawals are being restored progressively as those checks are completed, while deposit services remained open and were not affected by the incident, according to Binance.
The theft exceeds the $1.46 billion taken from Bybit in February 2025, making the Binance crypto heist the largest cryptocurrency theft recorded to date. Of the assets stolen across 11 blockchains, 82% were held on Ethereum and Bitcoin. Blockchain analysis firm Elliptic said this one incident almost doubles the amount previously attributed to North Korea-linked actors, which it estimates had already exceeded $6.5 billion in recent years.
Some of the stolen assets have been stopped from moving further. Of the $6.43 billion taken, $2.85 billion has been frozen on-chain, meaning directly on the relevant blockchain networks, by Tether, Circle, Ripple, Arbitrum and Optimism. The remaining laundering activity was still being tracked through conversions and associated wallet addresses.
TraderTraitor has operated since at least 2020 and has repeatedly targeted the Web3.0 industry, a term for online services and applications built around blockchains. Its earlier activity has included cryptocurrency thefts involving DMM Bitcoin, Bybit, KelpDAO and Bitget. A recurring tactic is to persuade targets to download applications containing malware, software designed to steal information or give an attacker access to a device.
Reports from SentinelOne, Zscaler ThreatLabz and Microsoft describe the group refining that approach with trojanized Terraform providers. A Terraform provider is a software component that lets the Terraform infrastructure tool manage cloud platforms and other services. In this campaign, attackers altered providers to distribute malware while using front companies and job opportunities to approach people working in cybersecurity, artificial intelligence, blockchain and recruitment businesses.
The malicious provider delivers a Bash loader, a script that runs commands and downloads additional software. It identifies the victim's operating system and retrieves malware suited to that platform. The chain includes FLATROOF, a cross-platform implant that uses a Python-based information stealer to collect sensitive data, followed by the ROOFDECK backdoor, which gives the attacker complete remote control. The process can work across macOS, Linux and Windows and is intended to establish persistent access.
Recruitment remains central to the social engineering. Similar campaigns, including Operation Dream Job and Contagious Interview, have used job offers or interview tasks to convince targets to run malicious code. The TraderTraitor activity also uses artificial intelligence to develop believable approaches, create false identities and avoid detection. Microsoft said the attackers built tailored domains and social media profiles, posed as recruiters for a fictitious AI-powered blockchain intelligence company and offered software engineering opportunities before arranging interviews. It also observed similar targeting supported by two additional front companies over a short period.
For website owners and IT teams, the poisoned developer-tooling method is particularly relevant because an infection can begin inside a trusted software workflow and then expose sensitive information or provide remote control of a developer's computer. Organisations reassessing their infrastructure and security practices can use AEU-I for security-first IT, infrastructure and consulting.
The incident combines two distinct risks: the immediate theft and laundering of cryptocurrency, and a longer-running campaign that uses recruitment approaches and altered development components to compromise people with access to valuable systems. Businesses should therefore examine both financial-account protections and the process used to approve software, interview exercises and infrastructure components before anyone runs them.