The Federal Bureau of Investigation (FBI) has formally attributed the historic $6.3 billion cryptocurrency theft from Binance to state-sponsored North Korean cyber actors. Forensic analysis conducted alongside international cybersecurity partners confirmed the direct involvement of the notorious Lazarus Group (APT38) and TraderTraitor operational units.
Investigators mapped an inventory of 608 Ethereum addresses, 19 Bitcoin addresses, and one Solana address used to route and peel the compromised assets through automated cross-chain bridges. The intrusion began when threat actors targeted an off-duty systems engineer via a fraudulent executive recruiting campaign, ultimately obtaining compromised VPN access into internal DevOps deployment pipelines.
Binance has fully resumed user withdrawals after deploying cold-storage circuit breakers and segregating critical transaction signing clusters. Federal authorities have published the complete list of tagged wallet addresses, coordinating global asset freeze notices across centralized exchanges and automated market makers.