FBI, Secret Service and IRS-CI Tie $6.43B Binance Crypto Theft to North Korean Crews

Key points

• FBI, U.S. Secret Service and IRS Criminal Investigation jointly attribute the Binance virtual-asset theft to North Korea.
• Losses are put at $6.43 billion for 2026, one of the largest crypto theft figures on record.
• The same activity is tracked under six aliases: TraderTraitor, Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899.
• No CVEs are associated with this advisory — it is an attribution and financial-threat notice, not a software patch bulletin.

The FBI, the U.S. Secret Service and IRS Criminal Investigation have jointly named North Korea as the state sponsor behind a very large theft of virtual assets from Binance, placing the 2026 loss at $6.43 billion. The attribution ties the operation to intrusion clusters that governments and private vendors have logged under a confusing spread of handles — TraderTraitor, Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899 — which appear to describe overlapping elements of one broader campaign rather than six unrelated crews.

The immediate victims are the exchange and the account holders whose balances were drained, but the blast radius reaches further. Stolen virtual assets are notoriously hard to claw back once they begin moving through mixers, bridges and over-the-counter desks, so recovery rates in cases of this size tend to be low. For public-sector organizations, the practical exposure is indirect but real: payroll and procurement fraud that leans on crypto rails, donation or scholarship wallets, and any district-sanctioned blockchain or Web3 coursework that touches real funds.

Why the attribution matters is that naming a state actor changes the response. It converts what looks like ordinary financial crime into a national-security and sanctions problem, which unlocks Treasury and law-enforcement channels, formal indictments, and blocking actions against associated addresses and infrastructure. It also signals intent: funds raised this way are generally treated as a revenue stream for a sanctioned government, which is why the figure keeps climbing year over year and why exchanges and payment processors face heightened scrutiny.

There are no CVEs in this notice, so nothing here is patched by a software update. The relevant defenses are identity, process and monitoring. Watch for follow-on Treasury or OFAC designations of wallet addresses, updated indicators from the named agencies, and any guidance aimed at exchanges and custodians. Internally, treat this as a reminder that credential phishing and business-email-compromise style payment diversions remain the most likely way a school district intersects with this threat.

For New Brunswick K-12, the takeaway is proportionate: no evidence suggests direct targeting of the department, but the aliases should be consolidated into a single watchlist tag, finance staff should be re-briefed on payment-detail changes, and any crypto-adjacent activity on district networks or accounts should be logged and reviewed rather than ignored.

What to do now

1. Consolidate all six aliases (TraderTraitor, Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, UNC4899) under one threat-actor tag in your intel or SIEM platform so detections and reports are not fragmented.
2. Enforce phishing-resistant MFA on email, finance systems and any account that can approve payments or vendor banking changes.
3. Re-brief finance and procurement staff on out-of-band verification for any request to change banking or crypto payment details, with a hard callback rule to a known number.
4. Inventory any district-sanctioned cryptocurrency wallets, donation portals or blockchain coursework that handles real funds, and confirm who holds keys and approvals.
5. Alert on cryptocurrency mining tooling, wallet browser extensions and unusual outbound traffic to exchange or mixing services from staff endpoints.
6. Subscribe to FBI and Treasury/OFAC updates on this campaign and push new sanctioned wallet addresses into your monitoring or blocklists as they are published.
7. Run a short tabletop on a suspected crypto-related fraud or account takeover, including escalation to your SOC, legal counsel and the local FBI field office.

Original source

The Hacker News