FBI attributes 6 billion dollar crypto heist to North Korea

On October 31, 2026, the FBI alongside the U.S. Secret Service and IRS Criminal Investigation formally attributed the theft of over six billion dollars from Binance to North Korean state-sponsored operators known as TraderTraitor or Lazarus Group. Authorities published a blacklist containing hundreds of wallet addresses and warned that the attackers are rapidly laundering these funds through decentralized finance channels and instant swap platforms.

This operation demonstrates that state-sponsored groups do not confine their activities to cryptocurrency platforms. These well-funded units regularly target software providers, payment systems, and commercial networks to secure revenue and access corporate infrastructure. Any commercial business processing digital payments or relying on connected financial supply chains faces direct compliance and security exposure.

Technical findings revealed that the attack began on a DevOps engineer workstation, allowing the intruders to pivot directly into internal cloud containers. The threat actors distributed poisoned infrastructure utilities, including trojanized Terraform providers, which installed the FLATROOF infostealer and ROOFDECK backdoor on administrative computers across Windows, Linux, and macOS. In a related critical development, authorities highlighted active exploitation of GitLab vulnerability CVE-2026-97229, setting an urgent remediation deadline of November 1, 2026.

Many small and medium enterprises now rely on cloud configurations and automated software deployment pipelines. When an administrative workstation or developer tool is compromised, conventional perimeter security is bypassed completely. Intruders gain immediate reach into core databases, commercial systems, and operational containers.

The incident triggered an operational halt that temporarily paralyzed withdrawal operations on Binance. While the exchange began phased restorations on November 1 across major networks and utilized corporate reserves to cover losses, centralized stablecoin issuers Tether and Circle, along with governance councils, successfully froze 2.85 billion dollars in digital assets before they could be laundered.

For retail chains and commercial companies that use modern settlement systems or maintain corporate liquidity across digital platforms, sudden freezes can interrupt operational cash flow overnight. Additionally, assets held too close to flagged wallets face immediate intervention from automated compliance filters.

Investigative reports noted that the attackers gained initial access by deploying hyper-realistic, artificial intelligence-generated recruitment lures and fake executive identities on professional networks like LinkedIn. Administrative staff and software engineers were targeted with fraudulent technical assessments and tools that secretly executed malicious loaders.

Small and mid-sized organizations rarely have dedicated intelligence teams, making their IT personnel prime targets for personalized social engineering. Artificial intelligence allows threat actors to craft convincing messages that easily bypass standard spam filters and deceive experienced staff.