Binance lets customers withdraw again as the FBI blames Pyongyang for the multibillion-dollar raid
According to the US federal police, the largest crypto theft ever is the work of the TraderTraitor group; in the first hours after reopening, customers pulled out billions.
On Saturday the FBI attributed the theft of more than 6 billion dollars in cryptocurrency from Binance to TraderTraitor, a group with ties to North Korea that is believed to be part of the Lazarus group, the AFP news agency reports. It is the largest crypto theft ever, well above the 1.5 billion dollars that disappeared from Bybit in February 2025. According to The Hacker News, the loot was moved across eleven blockchains, 82 percent of it via Ethereum and Bitcoin. The FBI saw the perpetrators converting the money into ether, expects further laundering through decentralised finance services and published the wallet addresses used.
Binance says it will bear the damage itself. The platform set aside more than 6.34 billion dollars of its own funds and bought tokens to replace most of the stolen assets, AFP wrote; according to Reuters, 95 percent was covered by Sunday and Binance began reopening withdrawals in phases, including in bitcoin and ether. Stablecoin issuers and blockchain networks such as Tether, Circle, Ripple, Arbitrum and Optimism together froze 2.85 billion dollars, according to The Hacker News. VRT NWS also carried Binance's response.
Customers took immediate advantage of the reopening. In the first nine and a half hours, a net 3.64 billion dollars flowed out, about 2.1 percent of the assets on the platform, The Block calculated. News of the attack had already pushed the crypto market down on Friday: bitcoin lost almost 5 percent, ether almost 6 percent and BNB, Binance's own token, almost 10 percent.
According to The Hacker News, TraderTraitor has been active since at least 2020 and lures victims with fake job offers, front companies and infected software. Microsoft saw the group posing as recruiters for a non-existent AI company focused on blockchain, and its targets often work in cybersecurity, AI or blockchain. According to the analytics firm Elliptic, this single raid almost doubles the total North Korea has stolen in cryptocurrency in recent years.