tradertraitor

FBI confirms North Korea’s involvement in Binance attack: ETH becomes a key focus of tracking, but attribution is no signal that prices have bottomed
On October 31, Beijing time, the FBI issued an official notice stating that North Korea was responsible for stealing more than $6 billion in virtual assets from Binance around October 29, and referred to these activities as TraderTraitor. What matters more to the market than the conclusion of “who did it” is the FBI’s statement that the attackers primarily converted the stolen assets into ETH, and may next continue laundering them through DeFi and instant exchange services.
This makes ETH two things at once: a key on-chain asset to track, and a window into whether the market thinks the stolen funds could create selling pressure. The FBI also urged nodes, DeFi platforms, instant exchange services, and other virtual asset service providers to block transactions associated with the relevant addresses. But “observed being converted into ETH” does not mean the funds have reached an exchange, nor does it mean ETH spot markets are about to be hit with a sell-off.

Most people have heard of the Lazarus Group, but far fewer know about TraderTraitor — one of the most notorious names associated with North Korea’s state-sponsored cyber operations.
TraderTraitor is not an ordinary hacking group. It is a name used by the FBI to track specific North Korean cyber operations targeting cryptocurrency and blockchain companies.
Here is what makes this group so significant:
🔹 State-Sponsored Operations
The FBI, CISA, and U.S. Treasury have identified TraderTraitor as North Korean state-sponsored cyber activity. It is also associated with the broader Lazarus Group ecosystem.
🔹 Connections to North Korea’s Intelligence Agency
In September 2019, the U.S. Treasury identified Lazarus Group as a North Korean government-controlled entity connected to the Reconnaissance General Bureau (RGB), the country's primary intelligence agency.
🔹 The $1.5 Billion Bybit Hack
On February 21, 2025, Bybit suffered a massive cryptocurrency theft worth approximately $1.5 billion.
On February 26, 2025, the FBI officially attributed the attack to North Korea and referred to the specific malicious cyber activity as TraderTraitor.
🔹 The $308 Million DMM Bitcoin Theft
In May 2024, North Korean cyber actors associated with TraderTraitor stole approximately $308 million from Japan-based DMM Bitcoin.
Investigators revealed that the attackers used a fake LinkedIn recruiter identity and a malicious coding test to compromise an employee.
🔹 A Much Longer History
North Korean cyber operations have also been linked to several major incidents:
• 2016 Bangladesh Bank heist — approximately $81 million stolen, involving Lazarus Group and its associated financial cyber operations.
• 2014 Sony Pictures cyberattack — attributed to North Korea by the FBI and linked to Lazarus Group.
• 2022 Axie Infinity Ronin Bridge hack — approximately $620 million stolen, attributed to Lazarus Group by the FBI.
🔹 Where Does the Money Go?
According to the U.S. Treasury, North Korea uses illicit cyber operations and cryptocurrency theft to generate revenue for the regime, including funding its weapons of mass destruction and ballistic missile programs.
The exact amount of stolen money that reaches specific government programs is difficult to independently establish.
The Bigger Picture
TraderTraitor represents a growing challenge for the global cryptocurrency industry.
These operations do not always begin with sophisticated code. Sometimes, they start with a fake job offer, a LinkedIn message, or a seemingly harmless coding test.
The lesson is clear:
In crypto, the biggest security threat may not always be a smart contract vulnerability. Sometimes, it is the person you trust.
#TraderTraitor #LazarusGroup #NorthKorea #CyberSecurity #CryptoSecurity #Bybit #Blockchain #CyberWarfare

⏱ Reading time: 5.5 minutes
Date: October 31, 2026
Hello, colleagues!
Official investigations by leading analytical agencies (Chainalysis, TRM Labs, Elliptic) confirm what we have been saying from the very first minutes: the market did not face an ordinary bug, but a targeted operation by intelligence agencies that had been prepared over a long period.