Search — “APT38”
2 stories · 0 IoCs
Stories
FBI attributes ~$6.36B Binance crypto theft to North Korea's TraderTraitor; 628 laundering addresses published
The FBI formally attributed the October 29, 2026 theft of roughly $6.36 billion in virtual assets from Binance to TraderTraitor (also tracked as Lazarus Group, Jade Sleet, APT38) and published 628 associated cryptocurrency addresses for exchanges and VASPs to block. Binance linked the breach to a compromised DevOps engineer's laptop that let attackers access a service container and submit unauthorized withdrawals, with most funds moved within 20 minutes. Hunters should look for laundering-address matches in blockchain monitoring and, for their own environments, prior-style patterns such as developer-workstation compromise via fake recruiter or test-code lures.
Binance suffers ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute to North Korea's TraderTraitor
Binance confirmed that about $6.3B was withdrawn from its wallets on October 29, 2026, after a DevOps engineer's compromised laptop enabled attackers to access a service container and submit unauthorized withdrawals. Binance has not attributed the attack to any group, while TRM Labs and Chainalysis attribute it to TraderTraitor (Lazarus/APT38) with high confidence. Binance says it has not found evidence of a leaked wallet private key and that it uncovered additional breach points; sources do not publish technical detection artifacts, so hunters should focus on withdrawal service container access and anomalous withdrawal transactions.