The FBI has attributed a cryptocurrency theft exceeding $6 billion to the North Korea-aligned hacking group TraderTraitor, The Hacker News reported on November 1. Binance said it was resuming withdrawals in stages after pausing them following the incident, while deposit services remained open and unaffected.
The report puts the theft at $6.43 billion across 11 blockchains, with 82% of the stolen funds on Ethereum and Bitcoin. It says $2.85 billion has been frozen on-chain—restricted on the blockchain—by Tether, Circle, Ripple, Arbitrum and Optimism. The reported haul exceeds the $1.46 billion stolen from Bybit in February 2025, making it the largest cryptocurrency theft reported to date.
For Binance customers, the immediate consequence is a gradual return of withdrawals. For cryptocurrency businesses and developers, the attribution also draws attention to a group whose documented campaigns use fake recruitment opportunities and compromised development tools to steal information and gain remote access.
Withdrawals resume as investigators track the funds
The FBI, the U.S. Secret Service and the Internal Revenue Service Criminal Investigation said they had observed the attackers converting stolen assets primarily into Ethereum, or ETH, The Hacker News reported. The FBI expects further laundering through decentralized finance services, commonly called DeFi, and instant cryptocurrency swaps. That expected next step is distinct from the conversions investigators said they had already observed.
The agency also released wallet addresses it said the attackers were using to launder the assets.
Binance said its first phase of withdrawal restoration began on November 1, between 06:00 and 09:00 UTC. In its statement reproduced by The Hacker News, the exchange said it had taken precautionary measures, assessed security and checked the readiness of affected services. Further withdrawals would return progressively as those checks were completed.
Blockchain analysis firm Elliptic described the theft as almost doubling the total cryptoassets stolen by North Korea. In the statement quoted by The Hacker News, Elliptic said actors linked to the country were believed to have stolen more than $6.5 billion in recent years.
TraderTraitor is also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. Active since at least 2020, it has a history of persuading cryptocurrency-sector targets to download applications containing malware. Earlier thefts attributed to the group include attacks against DMM Bitcoin, Bybit, KelpDAO and Bitget.
Recruitment lures reach into developer workflows
Separate reporting described by The Hacker News, drawing on SentinelOne, Zscaler ThreatLabz and Microsoft, shows the group using malicious Terraform providers and front companies to target people working in cybersecurity, AI, blockchain and talent recruitment.
Terraform providers are components used by an infrastructure-management tool to interact with services. In the reported attack chain, a provider altered to contain malicious code delivers a Bash loader—a script that downloads and starts further malware. The loader selects a payload for the victim’s operating system, allowing the campaign to reach macOS, Linux and Windows systems.
The chain includes FLATROOF, an implant that uses a Python-based information stealer to collect sensitive data, followed by the ROOFDECK backdoor, which gives attackers remote control and persistent access. These findings describe the group’s broader methods rather than an established entry point for the newly reported theft.
In an October 29 analysis, Microsoft Threat Intelligence said Jade Sleet launched campaigns through three front companies in a single week. One posed as an AI-powered blockchain intelligence company. The attackers used tailored domains, social media profiles and industry knowledge to approach prospective software engineers and arrange interviews. Two additional fronts supported similar recruitment campaigns within that period.
Microsoft assesses that AI use is established across Jade Sleet’s operational workflows. The company described AI as accelerating existing activities, including lure creation, fake-persona development and infrastructure work, while assessing that North Korean AI-enabled operations remain human-directed.
Its broader findings included Onyx Sleet producing dozens of tailored lures in minutes, Coral Sleet rapidly developing a way to insert malicious code into private source repositories, and Diamond Sleet using AI to support targeting, personas and front companies. Microsoft also said Onyx Sleet and Pearl Sleet were using ARTEX, an open-source AI framework for penetration testing. Those observations concern distinct groups and should not be read as methods established in the cryptocurrency theft.
Actions for security teams and recruiters
Microsoft’s guidance addresses the wider North Korean threat landscape, spanning phishing, malware, exposed systems and employee infiltration. For organizations facing recruitment-themed attacks, it recommends training users to recognize unsolicited approaches, suspicious attachments and requests arriving through social networks or messaging applications, and to report suspicious activity.
Hiring teams should scrutinize staffing-company candidates, compare names, addresses and dates across applications and background checks, and verify references by phone or video. Microsoft also recommends checking for duplicated professional profiles or phone numbers, looking for the same persona employed at multiple companies, and holding multiple video sessions. Repeated camera or microphone problems are a warning sign in its guidance, alongside an absent or inconsistent digital footprint.
Security administrators should keep antivirus definitions and real-time protection current, enable cloud-delivered protection and use endpoint detection and response tools that can block malicious activity after an initial breach. Microsoft lists the Defender for Endpoint alert “Jade Sleet threat actor activity detected” among its relevant detections.
For Microsoft environments, its recommendations include Safe Links and Safe Attachments, retroactive removal of malicious email through Zero-hour auto purge, and blocking device code authentication wherever possible. Where that authentication method is necessary, administrators should control it through Microsoft Entra Conditional Access policies.
Microsoft also recommends reducing public exposure of systems, using protected network access where possible, placing necessary public servers behind protective infrastructure, and automating patching. Its attack surface reduction guidance includes blocking executable email content, untrusted executables and potentially disguised scripts. Responders can use its mail investigation tools to find and remove delivered phishing messages, including messages with subjects or URLs similar to known malicious examples.
