Search — “TraderTraitor”
3 stories · 0 IoCs
Stories
Binance attributes $6.34B theft to North Korea-linked compromise of three engineers' machines via fake recruiting, tampered Homebrew, and internal AI tool abuse
Binance's initial incident report says attackers ran a months-long campaign starting June with a tampered Homebrew download, then a September fake job interview leading to a malicious coding assignment that installed undetected malware. Attackers used the infected machine and an internal AI tool on October 20 to take over two engineers' systems, then deployed a container using a token from the first engineer to reach the wallet signing service and move hot-wallet assets, including abuse of EIP-7702 delegations. Hunters should look for unexpected package-manager installs of developer tools, malicious repository execution, container deployments using engineer tokens, and EIP-7702 authorizations; the FBI attributes the theft to TraderTraitor, a claim North Korea rejects.
FBI attributes ~$6.36B Binance crypto theft to North Korea's TraderTraitor; 628 laundering addresses published
The FBI formally attributed the October 29, 2026 theft of roughly $6.36 billion in virtual assets from Binance to TraderTraitor (also tracked as Lazarus Group, Jade Sleet, APT38) and published 628 associated cryptocurrency addresses for exchanges and VASPs to block. Binance linked the breach to a compromised DevOps engineer's laptop that let attackers access a service container and submit unauthorized withdrawals, with most funds moved within 20 minutes. Hunters should look for laundering-address matches in blockchain monitoring and, for their own environments, prior-style patterns such as developer-workstation compromise via fake recruiter or test-code lures.
Binance suffers ~$6.3B crypto theft via compromised DevOps laptop; TRM and Chainalysis attribute to North Korea's TraderTraitor
Binance confirmed that about $6.3B was withdrawn from its wallets on October 29, 2026, after a DevOps engineer's compromised laptop enabled attackers to access a service container and submit unauthorized withdrawals. Binance has not attributed the attack to any group, while TRM Labs and Chainalysis attribute it to TraderTraitor (Lazarus/APT38) with high confidence. Binance says it has not found evidence of a leaked wallet private key and that it uncovered additional breach points; sources do not publish technical detection artifacts, so hunters should focus on withdrawal service container access and anomalous withdrawal transactions.