According to the US Federal Bureau of Investigation (FBI), North Korean hacking group, known as Lazarus Group, is to blame for October 29 attack to TraderTraitor. The FBI, alongside the US Secret Service and blockchain analysts, has identified the group as responsible for the incident.
North Korea denied the charges about its involvement in the theft of 6.3 billion dollars from the cryptocurrency exchange Binance, calling these accusations politically motivated. Kim Yo-jong, sister of the North Korean leader Kim Jong Un, stated on Tuesday that their country is often connected to cybercrimes by the United States without proper explanation.
Kim said:
The US has made a trite provocation of linking it with the Democratic People’s Republic of Korea again. It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.
The FBI has urged cryptocurrency exchanges and other industry participants to identify and block transactions involving wallet addresses associated with TraderTraitor.
Hack involved compromised engineer devices
After the breach, it became known that the hackers had spent months trying to attack Binance workers and their internal systems. Initial investigations showed that an engineer’s laptop was hacked allowing criminals to withdraw money from the exchange’s wallets. It was also reported that the hackers used malware and conducted fake job interviews with Binance workers in order to receive information.
The attack has renewed scrutiny of North Korea’s alleged involvement in major cryptocurrency thefts. TraderTraitor, which is associated with the Lazarus Group, was previously linked by US authorities to the $1.5bn Bybit hack in February 2025.
North Korea is repeatedly denying its involvement in the cyberattacks. International researchers have reported that the country has developed organised cyber operations, including recruiting technically skilled university students and assigning them to hacking units overseen by its intelligence services.
Binance reports $4.72bn in net withdrawals
Meanwhile, Binance has reported substantial customer withdrawals following the incident. A spokesperson told the BBC that net withdrawals reached $4.72bn after trading and transactions resumed on Sunday. The figure represents a relatively limited proportion of Binance’s total assets, estimated at approximately $157bn, and includes the effects of the hack, subsequent withdrawals and cryptocurrency price movements.
Spokesperson added:
Withdrawal levels are stabilising to what we would consider normal and expected on-chain activity.
Binance has also confirmed that it will cover the losses associated with the incident. The company said it has already covered approximately 95% of the stolen assets, while working with cryptocurrency issuers to freeze affected funds.
