#Binance #BinanceSquareTalks Issued an official statement on October 31:
North Korea - TraderTraitor Group
Details:
TraderTraitor is an elite unit belonging to the Lazarus Group—the largest hacking network affiliated with North Korea’s military intelligence
Bureau 121—a cyberwarfare unit with 6,000 hackers, operating even from Belarus, China, India, and Malaysia
It also goes by the names Jade Sleet, APT38, and Bluenoroff
How did they get in?
A Binance DevOps engineer’s laptop was hacked
They used it to access a service container and approve fake withdrawals
No private keys were leaked
$6.36B moved out in just 20 minutes across 10 blockchains; 1,113 transfers over 3 days
What they did with the money:
They used 60M USDT on Aave to borrow 19,762 Wrapped ETH
Now they’re moving it: BTC → ETH → SOL to make tracking harder
An automated system moves the money 24/7
The FBI published 628 addresses: 608 Ethereum, 19 Bitcoin, 1 Solana—and asked platforms to block them
$2.85B has already been frozen with help from Tether and Circle
Their track record:
Bybit, February 2025: $1.5B (the biggest heist before this one)
Japan’s DMM Bitcoin, 2024: $308M — they gained access through a fake job offer on LinkedIn
Bitget, September 2026: $387.5M
Drift, April 2026: $280M
North Korea responded today, November 3:
Kim Yo Jong (Kim Jong Un’s sister) said on KCNA:
“Ridiculous accusations—a malicious attempt to tarnish our reputation”
The UN says hacking generates half of North Korea’s foreign currency#BinanceReopensWithdrawalsForMoreAssets $PEPE .
