The FBI says North Korea’s TraderTraitor operation was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October, and six security outlets that covered the attribution agree on that point while giving different totals, different frozen amounts and different accounts of how the intrusion began.
The bureau’s alert, published on 31 October, says the FBI, the Secret Service and IRS Criminal Investigation have watched TraderTraitor actors convert the stolen assets “primarily into Ether (ETH)” and expect further laundering through DeFi and instant swap services. It lists the addresses holding or having held the proceeds and urges THORChain node operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions with or derived from them. The alert carries no named spokesperson and no detail on the intrusion itself.
That gap is where the coverage diverges. We read accounts from The Record, The Register, SecurityWeek, Help Net Security, CSO Online and Infosecurity Magazine, alongside the FBI alert and Elliptic’s on-chain analysis.
Where the accounts agree
All six name TraderTraitor and tie it to North Korea, and all six report that Binance has said it will cover customer losses. Most also place the theft in the group’s history. Infosecurity Magazine lists earlier TraderTraitor thefts from DMM, Alphapo, CoinsPaid and Atomic Wallet and notes the group “was also blamed for the previous record setter,” the $1.5 billion Bybit theft. SecurityWeek and The Register make the same Bybit comparison. Elliptic’s own analysis, by Dr. Tom Robinson, the firm’s co-founder, puts the scale plainly: “This is almost certainly the largest single theft of any kind in history.”
Where they differ: who named North Korea first
The accounts also credit the attribution differently. SecurityWeek reports that TRM Labs and Chainalysis linked the attack to TraderTraitor within hours, two days before the FBI alert. The Register says TRM Labs and Elliptic had linked the theft to North Korea before the bureau “weighed in,” and Elliptic’s own update says it “had assessed this as likely.” The Record and Help Net Security lead with the FBI and the Secret Service. The address counts line up where outlets give them: Help Net Security reports 628 addresses and SecurityWeek breaks them into 608 Ethereum, 19 Bitcoin and one Solana address. The Register adds that the group has previously used fake job offers and recruitment exercises to get employees to hand over access, which fits Binance’s early account of an engineer’s device as the first foothold.
Where they differ: the number
The size of the theft depends on whose count an outlet leads with. SecurityWeek and Help Net Security use Binance’s estimate of roughly $6.3 billion. The Register gives three figures in one paragraph: TRM Labs’ $6.36 billion, Elliptic’s $6.43 billion, and Binance’s own number. Elliptic’s figure excludes a further $169 million that left Binance after withdrawals were suspended, which it attributes to Binance moving its own funds.
The frozen amount varies more. The Record cites blockchain security experts saying “about $3 billion has been frozen so far,” and Help Net Security says Tether, Circle and other partners froze close to $3 billion within the first day. The Register reports Elliptic’s narrower figure: $2.85 billion “verified” as frozen or seized. Elliptic says that $2.85 billion is 44% of the theft and almost all of it USDT and USDC, the stablecoins whose issuers can freeze them. The difference matters for anyone estimating what is still in motion.
Where they differ: the entry point
The starkest split is over how the attack began. CSO Online’s headline says a compromised DevOps laptop caused the breach, based on Binance’s preliminary finding that an engineer’s device gave access to a service container used in withdrawals. The Register reports the same laptop account as Binance’s admission. SecurityWeek, The Record and Infosecurity Magazine lead instead with Binance’s later statement that its investigation “has uncovered additional points of breach,” with co-CEO Richard Teng describing a complex attack that “was not carried out by one person” and a self-destruct mechanism that wiped tooling as it ran.
Elliptic’s analysis adds the on-chain view that none of the laptop-first accounts carries. It says the evidence suggests the attacker did not steal Binance’s private keys but got Binance’s own systems to sign transactions on its behalf, and it quotes Teng saying the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.”
Where they differ: what the story is about
Each outlet also chose a different second story. The Record follows the laundering, quoting Elliptic that the funds moved on “autopilot” and a Chainalysis investigator on automation set up in advance. The Register follows the money leaving Binance, with about $3.64 billion in net outflows after withdrawals resumed. Help Net Security follows the users, including fake posts promising a $150 compensation payment. CSO Online follows control design, quoting Mario Rivas of NCC Group that “a platform holding digital assets should have multiple layers of security to prevent a single compromise, such as an employee’s laptop being hacked, from being sufficient to authorize a transfer.”
What the coverage adds up to
Read together, the six accounts describe two separate steps in one intrusion, and only the second is specific to crypto. The first is familiar: a privileged engineer’s endpoint was, by Binance’s early account, a way in. The second is that a withdrawal pipeline signed and sent transactions that its own approval controls did not see, without a key ever leaving the building. No single article states both halves. The laptop headline makes it sound like a phishing story, and the laundering coverage makes it sound like a blockchain story.
In our reading, the lesson for defenders outside crypto sits in that second half. Any organisation that runs an automated service able to move money or sign on its behalf, whether a payment release job, a treasury integration or a code-signing service, has the same shape of risk: the service is trusted to sign what it is handed, and a new type of request can bypass the checks built for the old types. Binance has promised a technical post-mortem; until it publishes, the additional points of breach are unknown and any account of the exact path is speculation.
The laundering coverage carries a second operational point. The Record quotes Elliptic warning that “a wallet that clears today can receive funds from this cluster hours later.” The FBI’s address list is a snapshot, and screening against it once does not cover funds that move on.
What it means for the security leader
- Treat engineers with access to signing, payment or release services as privileged users: dedicated hardened devices, phishing-resistant authentication and session monitoring, with the same rigour as domain administrators.
- Map every automated path that can authorise a transfer or signature, and require an independent approval for any transaction type the controls were not designed for, whatever its value.
- If you screen counterparties or payments against threat lists, screen continuously against updated feeds, including the FBI’s published addresses, rather than once at onboarding.
- Expect scams to follow a large incident. Help Net Security’s report of fake compensation offers is a reminder to brief customer-facing staff on official channels within hours.
Our earlier coverage of a fake Terraform file that rooted an IT services firm shows how this group reaches engineers, our brief on Bitget’s hot wallet loss covers a similar backend compromise, and our cross-press reading of the BeyondTrust zero-day found the same pattern of agreement on facts and divergence on scale.
Source: FBI, North Korea Responsible for $6 Billion+ Binance Attack
