TraderTraitor — Binance US$6.3B+ Theft, Cross-Chain Extraction & Laundering Infrastructure

FBI attributes the >US$6B Binance theft on/about 2026-10-29 to DPRK activity tracked as TraderTraitor and publishes laundering addresses/expected ETH-DeFi-swap path.

لا يثبت: Does not establish exact initial access, every derived address, or equivalence with unrelated DPRK clusters.

Binance confirms ~US$6.3B unauthorized withdrawals; initial laptop hypothesis was followed by additional breach points; no evidence wallet private keys leaked; full sequence pending.

لا يثبت: Does not independently attribute actor or establish the laptop as sole root cause.

TRM attributes the attack to TraderTraitor with high confidence; ~US$6.36B moved across ten chains, mostly in ~20 minutes; Ethereum used EIP-7702 sweeper with 50 pre-signed authorizations, other chains ordinary signed transfers.

لا يثبت: Ethereum-specific authorization mechanism does not explain all chains or the endpoint/root compromise.

Elliptic measured ~US$6.43B across 11 chains, assessed DPRK-linked actors likely responsible, linked some proceeds to prior suspected DPRK proceeds and verified ~US$2.84B frozen at its measurement time.

لا يثبت: Valuation/chain/freeze totals are timestamp-and-scope sensitive; address overlap alone does not universalize operator identity.

At 2026-10-31 08:48 UTC Elliptic observed ~US$93.5M fan-out from a main Tron distribution wallet to ~150 wallets with repeated top-ups and accelerating movement.

لا يثبت: Does not establish final laundering topology, final ownership of every wallet or eventual fiat cash-out.

FBI and partners say TraderTraitor activity is also tracked as Jade Sleet, UNC4899 and Slow Pisces and document a prior DMM/Ginco targeted-social-engineering/session-abuse chain.

لا يثبت: Historical alias/method evidence does not prove Binance reused the same initial-access chain or that every generic DPRK/Lazarus label is equivalent.

On 2026-11-01 Binance began phased withdrawal restoration after security/readiness checks, continued residual-risk monitoring and recovery, reported ~95% asset replenishment, and said a post-incident report remains forthcoming.

لا يثبت: Service restoration/replenishment does not prove root-cause closure, eradication or final recovery/laundering state.