According to the CISA, TraderTraitor is a North Korean state-sponsored hacking group that has been associated with cryptocurrency thefts and cyberattack tactics since at least 2020.
The US' Federal Bureau of Investigation (FBI) has accused North Korea of being behind a major hack targeting the Binance cryptocurrency exchange earlier this week.
ADVERTISEMENT
ADVERTISEMENT
Binance suffered what its co-CEO Richard Teng described as a "complex attack" that saw hackers gain access to its hot wallets and steal $6.3 billion in digital assets.
"The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026," the FBI said in a statement on Saturday.
"The FBI refers to this specific North Korean malicious cyber activity as 'TraderTraitor,'" it continued, adding that it had observed TraderTraitor actors converting stolen assets into Ethereum and that it expected these to be "further laundered by converting them using DeFi and instant swap services."
According to the US' Cybersecurity and Infrastructure Security Agency (CISA), TraderTraitor is a North Korean state-sponsored hacking group that has been associated with cryptocurrency thefts and cyberattack tactics since at least 2020.
It is believed to be part of the Lazarus Group, which the CISA says has carried out attacks against a variety of blockchain and cryptocurrency industry targets using spearphishing campaigns and malware.
Following the Binance attack, the exchange announced that it had suspended deposits and withdrawals as its team carried out security checks, froze funds and worked with law enforcement operatives to investigate the incident.
The company said that it has now covered around 90% of the impacted amount stolen in the hack and that withdrawals were resuming "in phases."
Binance said the remaining 10% of tokens were "less liquid," meaning they could take longer to buy.
In a video statement posted on social media, Teng said the company was "committed to covering all hacked losses through our company funds."
"Your assets are safe," he added.
