The U.S. Federal Bureau of Investigation (FBI) has publicly attributed the theft of $6.43 billion in virtual assets to TraderTraitor, a North Korea–linked hacking cluster. Working with the U.S. Secret Service and the IRS Criminal Investigation unit, investigators say the group converted a large share of the stolen funds into Ethereum and began moving assets through decentralized finance (DeFi) and instant-swap services as part of a multi-stage laundering effort.
The scale of the theft
This incident dwarfs prior crypto heists, eclipsing the $1.46 billion taken from Bybit in February 2025 and making it the largest single cryptocurrency theft on record. The funds were taken across 11 blockchains, with approximately 82% of the value concentrated on Ethereum and Bitcoin. Blockchain analysis firm Elliptic observed that the haul substantially increases the total cryptoassets attributed to North Korea-linked actors, which the firm estimates exceed $6.5 billion in recent years.
What investigators say about the flow of funds
According to the FBI, the threat actor has been converting stolen assets primarily into Ethereum, a step likely intended to facilitate further laundering via DeFi protocols and instant swap services. The agency released a list of wallet addresses it believes the attackers are using to move and launder the proceeds. In parallel, several major token issuers and layer-2 networks have frozen $2.85 billion of the stolen assets on-chain; those actions were taken by Tether, Circle, Ripple, Arbitrum, and Optimism.
Who TraderTraitor is
TraderTraitor is the label analysts have applied to a North Korean-aligned crew that has been active since at least 2020. The group has been observed under several aliases, including Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. Over the years, the cluster has been linked to multiple notable intrusions and thefts in the Web3 space, with previously identified victims including DMM Bitcoin, Bybit, KelpDAO, and Bitget.
Tactics and tradecraft
Research from SentinelOne, Zscaler ThreatLabz, and Microsoft shows TraderTraitor continuing to advance its techniques. A recurring element is the abuse of trusted developer workflows: the group has distributed malware through trojanized Terraform providers. Those malicious providers deliver a Bash loader that detects the victim’s operating system and pulls down tailored malware. Reported components include a cross-platform information stealer named FLATROOF, which exfiltrates sensitive data via a Python-based stealer, and a follow-on backdoor called ROOFDECK that allows persistent remote access.
Social engineering is a core part of the operation. The cluster leverages recruitment-themed lures and front companies to reach targets, posing as recruiters or representatives of spoofed organizations. Analysts say the adversary has increasingly incorporated artificial intelligence to craft more convincing lures and fake personas, helping them evade detection and persuade targeted individuals—often those with roles in cybersecurity, AI, blockchain, or recruitment—to execute malicious code or install compromised tooling.
Exchange response and short-term fallout
Binance temporarily paused withdrawals following the incident. The exchange has since said it resumed phase one of withdrawals during a narrow window while continuing security assessments and readiness checks; deposits reportedly remained unaffected. The episode prompted coordinated on-chain freezes by token issuers and layer-2 providers as part of efforts to limit the attackers’ ability to cash out or further obscure the funds’ provenance.
Why this matters
Beyond the staggering dollar figure, this case underscores two persistent threats to the cryptocurrency ecosystem: the growing sophistication of nation-state–linked cybercriminal groups, and the vulnerability that arises when attackers compromise widely used developer tools and supply chains. The combination of technical malware delivery, targeted social engineering, and the exploitation of DeFi mechanics for laundering highlights how adversaries are adapting across multiple fronts to monetize intrusions at scale.
Licensed under CC BY-ND 4.0 International