What happened
The Federal Bureau of Investigation on Friday publicly attributed a $6 billion theft from Binance to TraderTraitor, a North Korean state-backed crew tracked by US intelligence as a subcluster of the Lazarus Group. Crypto Briefing first reported the bulletin, which lands as Treasury's Office of Foreign Assets Control is weighing fresh designations tied to crypto laundering infrastructure.
The FBI said the operation combined social-engineering of exchange staff with malware delivered through fake job offers, a tradecraft pattern TraderTraitor has used since 2022. Funds moved through a mix of cross-chain bridges and Tron-based stablecoin hops before fragmenting across hundreds of intermediary wallets. The agency did not disclose the exact window of the breach, saying only that the activity spanned multiple weeks.
Binance has not issued a public confirmation of the dollar figure or a breakdown of which hot wallets were drained. The exchange's last proof-of-reserves attestation, published earlier this month, did not flag a gap of that magnitude.
Why it matters
A $6 billion figure, if it holds up, tops the 2024 DMM Bitcoin theft and the 2022 Ronin bridge exploit by a wide margin and would reset the ceiling on state-linked crypto crime. The attribution also lands at a politically sensitive moment. The Treasury has spent most of 2026 pushing exchanges to adopt stricter travel-rule compliance, and a successful breach at the largest venue by spot volume undercuts the industry's argument that custody tooling has matured.