The U.S. Federal Bureau of Investigation (FBI) has officially linked a staggering theft of over $6 billion in digital assets to a North Korean hacking group known as TraderTraitor. This organization, also identified by names such as Jade Sleet and Pressure Chollima, is believed to have perpetrated the most significant cryptocurrency heist in history.
Details of the Cyber Heist
Collaborating with the U.S. Secret Service and the IRS Criminal Investigation, the FBI uncovered that the stolen assets were primarily converted into Ethereum. The agency noted that these assets are likely to be laundered further using decentralized finance (DeFi) platforms and instant swap services. Additionally, a list of wallet addresses used by the hackers for laundering purposes has been disclosed.
In the aftermath of this incident, Binance announced the resumption of its withdrawal services, which had been paused due to the security breach. The company assured users of their commitment to safeguarding the platform by conducting thorough security assessments.
Historical Context and Impact
This heist surpasses the previous record set in February 2025, where $1.46 billion was stolen from Bybit. The stolen funds span 11 blockchains, with a significant portion involving Ethereum and Bitcoin. According to blockchain analysis firm Elliptic, North Korean actors have allegedly stolen over $6.5 billion in crypto assets in recent years.
Of the $6.43 billion stolen, $2.85 billion has been frozen through efforts by Tether, Circle, Ripple, Arbitrum, and Optimism. TraderTraitor, active since 2020, has been linked to several major cryptocurrency thefts targeting the Web3.0 sector by deploying malware-laden applications.
Ongoing Threat and Strategies
Recent reports from SentinelOne and Microsoft highlight that TraderTraitor continues to refine its techniques, using trojanized Terraform providers to distribute malware. This method allows them to gain persistent access across various operating systems, including macOS, Linux, and Windows. The group’s strategy involves using job-themed lures to entice victims into executing malicious software.
The North Korean threat actors have been known to exploit trusted developer workflows, reflecting a pattern similar to other campaigns like Lazarus Group’s Operation Dream Job. With the aid of artificial intelligence, they create convincing fake personas and job offers to deceive targets.
Microsoft reports that the group used tailored domains and social media profiles to impersonate recruiters from a fictitious AI-powered blockchain intelligence firm. This tactic enabled them to engage with potential victims and schedule interviews, furthering their malicious objectives.
The incident underscores the ongoing threat posed by North Korean cyber groups and their continued evolution in employing sophisticated methods to achieve their ends.
