The two largest crypto thefts in financial history were carried out by the same group, the FBI confirmed that the Binance hack was the work of TraderTraitor, consistent with the Bybit hack.

BlockBeats news, November 1 — The U.S. FBI has formally determined that the theft of over $6 billion from Binance was carried out by the North Korean hacker group TraderTraitor. This group is also the mastermind behind the approximately $1.5 billion Bybit theft in February 2025, which the FBI had already explicitly attributed to TraderTraitor at the time.

Blockchain analysis firms TRM Labs, Chainalysis, and others previously pointed out that the Binance case's methods were highly similar to those of the Bybit case, and that some of the stolen funds were commingled with funds from the approximately $387 million Bitget theft in September 2026, indicating the involvement of the same network.

To date, the two largest thefts in cryptocurrency history (Binance and Bybit) were both carried out by the same North Korean hacker group. TraderTraitor is widely regarded as a core branch of the notorious "Lazarus Group," which has long raised funds for the North Korean regime through cryptocurrency theft. Its major large-scale thefts are as follows:

· DMM Bitcoin (Japan, May 2024): approximately $308 million (4,502.9 BTC). The FBI, the U.S. Department of Defense Cyber Crime Center, and Japanese police formally attributed it to TraderTraitor. Method: fake LinkedIn job recruitment lured an employee of wallet software company Ginco to run malicious code.

· Bybit (February 2025): approximately $1.5 billion. The FBI formally issued a public statement explicitly attributing it to TraderTraitor. It once set the record for the largest single theft in crypto history.

· KelpDAO (April 2026): approximately $292 million. Analysis firms such as TRM Labs pointed out that the methods (including small Tornado Cash deposits, pre-prepared signatures, etc.) closely matched TraderTraitor's past operations.

· Bitget (September 2026): approximately $350 million–$387 million. Multiple analysis firms (TRM, Chainalysis, ZachXBT, etc.) strongly linked it to TraderTraitor/the same North Korean network through fund commingling, overlapping money-laundering networks, and other factors.

· Binance (October 2026): approximately $6.3 billion. The FBI has formally confirmed it was carried out by TraderTraitor, setting a new all-time record.

· Earlier stages (2020–2022) also involved malicious crypto apps named "TraderTraitor" (Electron/Node.js framework) and phishing campaigns targeting developers.