{"rewrite":{"id":"r_b79201cec644212c2b6c41a1","clusterId":"c_98b7bbbe77b19793a38ce431","slug":"fbi-blames-north-korea-s-tradertraitor-for-6-3-billion-binance-theft","model":"deepseek-v4-1-flash","headline":"FBI Blames North Korea's TraderTraitor for $6.3 Billion Binance Theft","summary":"Binance disclosed about 6.3 billion US dollars (roughly 980 billion yen) stolen from the exchange as of the morning of October 30, 2026. The FBI later named North Korea's TraderTraitor, a unit tied to the Lazarus group, as the perpetrator. Bitcoin, Ethereum and stablecoins were taken, and the FBI said the group is mainly converting the funds into Ethereum while publishing wallet addresses for exchanges to block.","whyItMatters":"The FBI tying the Binance theft to the same TraderTraitor unit that Japanese and US authorities named in the DMM Bitcoin case puts the two incidents on one known playbook: recruiters approaching employees on LinkedIn and handing them a coding test loaded with malicious code.","webCardHtml":"\u003cp\u003eThe FBI identified the perpetrator as TraderTraitor, which materials from Japan\u0026#39;s National Police Agency and the US Department of Justice describe as part of Lazarus, an outfit inside North Korea\u0026#39;s Reconnaissance General Bureau. The names are not used by North Korean authorities; security companies and US authorities coined them.\u003c/p\u003e\u003cp\u003eThe route into the DMM Bitcoin case ran through an employee of wallet software provider Ginco. A person posing as a recruiter approached the employee on LinkedIn, sent a hiring test, and had the employee copy a test program to GitHub. The program carried malicious code, and the attackers are believed to have impersonated the employee inside Ginco\u0026#39;s systems and altered a legitimate DMM transfer request.\u003c/p\u003e","blueskyPost":"The FBI's naming of TraderTraitor turns this into a laundering race: the group is moving funds into Ethereum, and exchanges only get value from the wallet addresses if they act before conversion completes.","twitterPost":"Naming TraderTraitor matters less than the Ethereum conversion: wallet addresses only help exchanges that block the funds before the swap finishes.","threadsPost":"The FBI naming TraderTraitor is the attribution. The operational detail is the Ethereum conversion. Publishing wallet addresses gives exchanges a window to block funds, but that window closes as the stolen Bitcoin and stablecoins get swapped.","newsletterBlurb":"Binance put the damage at about 6.3 billion dollars (roughly 980 billion yen) on October 30, 2026, and the FBI named North Korea's TraderTraitor as the perpetrator. The group is largely converting stolen assets into Ethereum, and the FBI published wallet addresses for exchanges to block. TraderTraitor was also the name Japanese and US authorities gave in the DMM Bitcoin theft, where a fake recruiter on LinkedIn targeted an employee of wallet provider Ginco.","attributionJson":"[{\"source\":\"ASCII.jp\",\"url\":\"https://ascii.jp/limit/group/ida/elem/000/004/447/4447863/?rss\",\"title\":\"1 Trillion Yen in Cryptocurrency Stolen, FBI Says North Korea Was Behind It; Employee PCs Targeted\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":5506,"outputTokens":790,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1793659439,"createdAt":"2026-11-02T22:38:18.000Z","publishedAt":"2026-11-02T22:42:59.000Z","updatedAt":"2026-11-02T22:42:59.000Z"},"cluster":{"id":"c_98b7bbbe77b19793a38ce431","canonicalTitle":"1兆円の仮想通貨盗難、FBIが北朝鮮の犯行と指摘　狙われたのは社員のPCか","representativeArticleId":"a_92d955aa4093f78eccd37679","sourceCount":1,"writtenSourceCount":1,"writeAttempts":0,"isSolo":true,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"other\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-11-02T22:00:00.000Z","lastSeenAt":"2026-11-02T22:00:00.000Z","updatedAt":"2026-11-02T22:42:59.000Z"},"attribution":[{"source":"ASCII.jp","url":"https://ascii.jp/limit/group/ida/elem/000/004/447/4447863/?rss","title":"1兆円の仮想通貨盗難、FBIが北朝鮮の犯行と指摘　狙われたのは社員のPCか"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":[],"studios":[],"people":[],"type":"news","domain":"other","is_roundup":false},"keyFacts":["Binance disclosed about 6.3 billion US dollars (roughly 980 billion yen) in stolen cryptocurrency on October 30, 2026.","The FBI named North Korea's TraderTraitor as the perpetrator of the Binance theft.","Bitcoin, Ethereum and stablecoins were among the assets stolen from Binance.","The FBI published related wallet addresses and asked exchanges to block transactions.","TraderTraitor was also named in the roughly 48.2 billion yen DMM Bitcoin theft, which began with a fake recruiter approaching a Ginco employee on LinkedIn."],"pageLinks":{"healthSlugs":[],"storySlugs":[],"entities":[],"stories":[],"entitiesOk":true,"storiesOk":true}}