The U.S. Federal Bureau of Investigation has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. It is the largest cryptocurrency theft in history.
What happened
The haul eclipses the $1.46 billion plundered from Bybit in February 2025. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin, which points to a laundering path prepared across several networks rather than a single chain.
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism. That recovery depended on issuers and rollup teams acting on addresses while funds were still identifiable.
Binance said it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident. A staged restart is a reminder that incident response here is as much about controlled service resumption as it is about containment.
How it was done
The attribution statement names the group, the amount and the chains used. It does not describe how initial access was obtained, how signing or approval controls were reached, or which systems were touched.
So the honest summary is short: a named state-aligned group moved a very large balance out, and the spread across 11 blockchains suggests the exit path was planned ahead of the movement. Anything beyond that is not yet public, and teams should resist filling the gap with assumptions when planning their own reviews.
The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.
What to check
If your organisation holds, moves or signs for digital assets, these are worth confirming this week.
Confirm every signing path requires more than one person
List each key and multisig that can authorise a transfer, and record the quorum and the named holders. Test an approval end to end on a staging wallet. A single key, a shared device, or a quorum where one engineer controls two signers is the bad result.
Check what the signing interface actually shows
Have a signer compare the payload displayed on the hardware device against the decoded calldata from your own tooling, not the web frontend. If the device shows a blind hash and no one independently decodes the transaction, an operator cannot tell a routine transfer from a contract upgrade.
Review build and dependency integrity for wallet tooling
Pin dependencies with lockfiles, run npm audit signatures or the equivalent, and verify that deployed frontend bundles match a build you can reproduce from source. Unpinned packages, unsigned artifacts, or a bundle hash that does not match CI output all need an answer today.
Audit developer endpoints that touch treasury systems
Pull EDR inventory for machines with access to signing software or operational wallets. Check for personal package registries, unreviewed browser extensions and remote access tools. Treasury access from a general purpose laptop with broad install rights is the finding to act on.
Rehearse a pause and a staged resumption
Document who can halt withdrawals, how fast the switch takes effect, and what the phased restart looks like. Run it in a drill and time it. If the pause depends on one person being reachable, or if nobody can describe the restart criteria, fix that before you need it.
Have issuer and chain contacts ready in advance
Keep a current contact list and escalation route for stablecoin issuers and the rollups you use, stored outside your production environment. Test that someone answers. Freezes depend on reaching the right people within minutes, not on finding an email address during an incident.