The Two Largest Crypto Heists in History Were Carried Out by the Same Group: FBI Links Binance Theft to TraderTraitor

The cryptocurrency industry is facing a significant security development: the two largest thefts in crypto history have reportedly been attributed to the same North Korean-linked hacking group.

The Federal Bureau of Investigation (FBI) has identified TraderTraitor as the group responsible for the theft of more than $6.3 billion in digital assets from Binance. The attribution connects the Binance incident to the approximately $1.5 billion Bybit hack in February 2025, which the FBI had previously linked to the same group.

If confirmed by the final forensic and legal investigations, these cases represent more than two isolated exchange breaches. Together, they illustrate how state-linked cybercriminal networks are combining social engineering, malicious software, wallet infrastructure attacks, and sophisticated on-chain laundering techniques at an unprecedented scale.

A New Record in Crypto Theft

The Binance incident reportedly surpassed the Bybit attack as the largest cryptocurrency theft ever recorded. Although estimates may change as investigators trace additional wallets and identify the affected assets, the reported loss is measured in the billions of dollars.

The FBI’s attribution is particularly important because it aligns with earlier analysis from blockchain intelligence firms. Researchers at organizations such as TRM Labs and Chainalysis reportedly identified similarities between the Binance and Bybit attacks, including:

• Comparable operational patterns
• Repeated use of intermediary wallets
• Rapid movement of stolen funds across multiple chains
• Use of decentralized services and cross-chain conversion
• Overlapping laundering infrastructure
• Small preliminary transfers used to prepare later transactions

Blockchain transactions are public by design, but public visibility does not automatically make funds easy to recover. Attackers can divide assets into thousands of transfers, move them through multiple networks, swap tokens, and use privacy-enhancing services to complicate attribution.

Who Is TraderTraitor?

TraderTraitor is widely regarded as a core operational branch of the broader North Korean cybercrime ecosystem often associated with the Lazarus Group.

The group’s name reflects a recurring tactic: targeting individuals and organizations involved in cryptocurrency trading, blockchain development, digital asset custody, and financial infrastructure. Its operations have included fake recruitment campaigns, malicious applications, impersonation, and attacks on employees with access to signing systems or wallet-related software.

The United States government has repeatedly warned that North Korea-linked cyber actors use cryptocurrency theft to generate revenue for the regime. The FBI’s official cybercrime resources and advisories from CISA provide broader context on state-sponsored cyber operations and digital asset threats.

TraderTraitor’s significance lies not only in the value of the assets stolen, but also in the group’s ability to attack the human and organizational layers surrounding blockchain systems.

A Pattern Across Major Crypto Heists

The Binance and Bybit incidents form part of a broader sequence of attacks that have been associated with TraderTraitor or the same North Korean-linked network.

DMM Bitcoin: Approximately $308 Million

In May 2024, Japan-based exchange DMM Bitcoin suffered a loss of approximately $308 million, equivalent to around 4,502.9 BTC at the time.

Investigators attributed the incident to a social engineering campaign in which an attacker used a fake recruitment approach on LinkedIn to target an employee of Ginco, a company involved in wallet software. The employee was reportedly induced to execute malicious code, giving the attackers an opportunity to interfere with the company’s operational environment.

The case demonstrated a critical security reality: an attacker does not always need to compromise a blockchain directly. Gaining access to a developer, administrator, or transaction approval workflow can be enough to authorize a catastrophic transfer.

Bybit: Approximately $1.5 Billion

The February 2025 Bybit attack became the largest known crypto theft at the time, with losses estimated at roughly $1.5 billion.

The FBI publicly attributed the incident to TraderTraitor. The attack also drew attention to the risks associated with transaction approval systems, multisignature arrangements, and interfaces used to review complex digital asset transfers.

A multisignature wallet can reduce the risk of a single compromised key, but it is not a complete solution. If several signers are deceived, if the signing interface displays misleading information, or if an attacker compromises the surrounding infrastructure, a multisignature process can still be exploited.

KelpDAO: Approximately $292 Million

In April 2026, KelpDAO reportedly suffered a loss of approximately $292 million.

Security researchers noted several characteristics that appeared consistent with prior TraderTraitor activity, including small initial transfers associated with Tornado Cash, advance preparation of signing-related transactions, and carefully staged movements before the main exploit.

Attribution in cases such as this is often probabilistic rather than immediate. Analysts compare transaction behavior, infrastructure reuse, wallet relationships, malware patterns, and the timing of transfers before reaching a conclusion.

Bitget: Reported Losses of $350 Million to $387 Million

A September 2026 incident involving Bitget was estimated by different sources at between $350 million and $387 million.

Analysts reportedly identified connections between the stolen funds and wallets previously associated with TraderTraitor-linked activity. The suspected overlap included shared laundering routes, similar fund-splitting patterns, and assets that later became mixed with funds from other major thefts.

When multiple thefts use the same conversion services, bridges, or intermediary addresses, blockchain investigators can sometimes identify a broader operational network. At the same time, funds moving through common infrastructure do not automatically prove that every incident was conducted by the same individuals. Final attribution requires combining on-chain evidence with off-chain intelligence.

Binance: More Than $6 Billion

The Binance theft reportedly occurred in October 2026 and involved losses exceeding $6 billion. The FBI’s attribution to TraderTraitor now places it at the center of the largest crypto heist in history.

The scale of the incident is notable for two reasons. First, it demonstrates that the financial impact of a single compromise can now rival major traditional financial crimes. Second, it indicates that the group’s techniques have evolved from opportunistic phishing into long-term campaigns targeting complex digital asset ecosystems.

Why the Binance and Bybit Cases Matter

The connection between the two largest cryptocurrency thefts changes how the industry should evaluate exchange security.

1. The Blockchain May Not Be the Primary Weak Point

In many large-scale incidents, the underlying blockchain protocol continues to function as designed. The problem occurs at the points where people and applications interact with the chain:

• Exchange custody systems
• Developer environments
• Signing devices
• Transaction approval dashboards
• Cloud infrastructure
• Employee communication channels
• Third-party wallet software
• API keys and access credentials

This is why blockchain security must be treated as an end-to-end discipline rather than a question of smart contract code alone.

2. Social Engineering Remains Highly Effective

Fake job offers, investment opportunities, partnership proposals, and technical documents remain powerful attack vectors.

Employees working in blockchain companies are often exposed to a high volume of unsolicited messages. A malicious file or application may appear legitimate, especially when it is embedded in a realistic recruitment or business-development conversation.

Organizations should therefore assume that even technically experienced employees may become targets. Security training needs to cover not only passwords and phishing links, but also code repositories, remote-access tools, wallet software, browser extensions, and signing workflows.

3. Transaction Review Must Be Human-Readable

A transaction can look legitimate at a high level while containing dangerous details. Attackers may manipulate token approvals, contract interactions, destination addresses, or transaction parameters.

Security teams should use independent verification channels and require signers to confirm:

• The exact destination address
• The asset and amount being transferred
• Contract permissions being granted
• Network and chain identifiers
• The purpose of the transaction
• Whether the transaction matches an approved internal request

Blindly approving a transaction because it appears in a familiar interface is one of the most dangerous habits in digital asset operations.

4. On-Chain Tracing Is Powerful but Not Instantaneous

Public ledgers allow investigators to follow stolen assets in a way that is often impossible with traditional cash. However, tracing does not guarantee recovery.

Attackers may use:

• Cross-chain bridges
• Decentralized exchanges
• Token swaps
• Multiple intermediary wallets
• Privacy-enhancing services
• Over-the-counter brokers
• Dormant wallets activated only after long delays

The result is a continuing race between investigators and criminals. Exchanges, custodians, analytics firms, and law enforcement agencies must share information quickly, because the first few hours after an incident can be critical.

What Users and Organizations Can Do Now

The TraderTraitor cases offer practical lessons for both individual users and professional crypto teams.

Separate Long-Term Holdings from Active Trading Funds

Assets that are not required for daily trading should not remain connected to exchange accounts or internet-facing applications. A compartmentalized custody model can limit the amount exposed if a trading account, API key, or workstation is compromised.

Use Hardware-Based Transaction Approval

A hardware wallet can keep private keys isolated from general-purpose computers and reduce exposure to malware. However, the device does not replace careful transaction verification. Users must still check the address, network, amount, and contract interaction before approving a transfer.

Maintain Independent Seed Phrase Backups

A wallet’s recovery phrase should be generated and stored offline. It should never be entered into a website, messaging application, cloud document, or unknown software.

Users should also avoid photographing or digitally copying the recovery phrase. Physical backups should be protected from unauthorized access, fire, water, and accidental loss.

Treat Unsolicited Recruitment Messages as Security Events

For people working in Web3, a job offer or partnership request may be an attack attempt. Files, repositories, video-call applications, browser extensions, and wallet-related tools should be verified through a separate communication channel before installation or execution.

Add Operational Controls for Treasury Teams

Organizations managing significant digital assets should consider:

• Multiple independent approval layers
• Address allowlists and withdrawal delays
• Transaction simulation before signing
• Separate devices for signing and communication
• Strict role-based access controls
• Emergency pause procedures
• Continuous monitoring of wallet activity
• Regular review of third-party integrations
• Incident-response drills

No single control is sufficient against a well-funded adversary. The strongest defense is a combination of technical isolation, process discipline, and rapid detection.

What This Means for the Future of Crypto Security

The latest incidents reinforce a broader shift in the threat landscape. Cryptocurrency theft is no longer limited to attacking poorly secured personal wallets or exploiting obvious smart contract vulnerabilities. Large criminal groups are increasingly targeting the infrastructure that connects people, applications, exchanges, and blockchains.

The most valuable security improvements will likely come from:

• Better signing interfaces
• Clearer transaction simulation
• Stronger device isolation
• Improved employee security training
• Faster cooperation between exchanges and investigators
• More effective sanctions and asset-freezing procedures
• Automated detection of suspicious fund flows
• Greater transparency around custody architecture

For the industry, the central lesson is straightforward: private-key security is necessary, but it is only one part of the problem. Protecting digital assets also requires securing the devices, identities, applications, approval procedures, and communication channels that surround every transaction.

A Practical Layer of Protection for Individual Users

For individuals holding meaningful amounts of cryptocurrency, a hardware wallet can provide an important layer of protection by keeping private-key operations separate from an internet-connected computer.

OneKey hardware wallets are designed around offline key isolation and on-device transaction approval. This can help reduce the risk that malware on a computer silently extracts private keys. Users should still verify every transaction carefully and follow secure backup practices, because hardware-based custody cannot protect funds if a recovery phrase is exposed or a malicious transaction is approved.

The Binance and Bybit cases show why self-custody should be approached as a complete security process—not simply as purchasing a device. Secure key generation, offline backups, address verification, and disciplined signing habits all matter when defending against increasingly sophisticated crypto theft campaigns.