Independent record. Not associated with, endorsed by or operated by Binance. We will never ask you to connect a wallet, log in or pay to recover funds.
The Federal Bureau of Investigation, Department of Defense Cyber Crime Center, and National Police Agency of Japan are alerting the public to the theft of cryptocurrency worth $308 million U.S. dollars from the Japan-based cryptocurrency company DMM by North Korean cyber actors in May 2024. The theft is affiliated with TraderTraitor threat activity, which is also tracked as Jade Sleet, UNC4899, and Slow Pisces.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
In late March 2024, a North Korean cyber actor, masquerading as a recruiter on LinkedIn, contacted an employee at Ginco, a Japan-based enterprise cryptocurrency wallet software company.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
In late-May 2024, the actors likely used this access to manipulate a legitimate transaction request by a DMM employee, resulting in the loss of 4,502.9 BTC, worth $308 million at the time of the attack.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
The Federal Bureau of Investigation (FBI) is releasing this PSA to advise the Democratic People's Republic of Korea (North Korea) was responsible for the theft of approximately $1.5 billion USD in virtual assets from cryptocurrency exchange, Bybit, on or about February 21, 2025.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
The following Ethereum addresses are holding or have held assets from the theft, and are operated by or closely connected to North Korean TraderTraitor actors:
Reviewer note: Event time is a date only. The 00:00 UTC time shown is a placeholder, the source gives no time of day. Earlier case, kept for comparison with the October 2026 attribution record.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026.
The FBI said it had observed hackers converting stolen assets into a type of cryptocurrency called Ethereum and that it is expected that the assets will then be converted again using decentralised finance and instant swap services.
The Federal Bureau of Investigation (FBI) is releasing information advising the Democratic People's Republic of Korea (North Korea) was responsible for the theft of more than $6 billion USD in virtual assets from cryptocurrency exchange Binance, on or about October 29, 2026. The FBI refers to this specific North Korean malicious cyber activity as "TraderTraitor."
The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages.
FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.