Skip to navigation

Threat reportAPTTL-2026-5164

TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft

criticalACTIVE

Binance disclosed that a months-long campaign attributed by TRM Labs, Chainalysis and U.S. agencies to North Korea's TraderTraitor unit led to the theft of roughly $6.3-6.4 billion in crypto on 2026-10-29, the largest recorded crypto heist. Reported access vectors include a fake job-interview assignment and malware disguised as an AI coding tool, followed by lateral movement, credential theft and abuse of internal wallet signing/transaction-authorization tooling; North Korea denies responsibility.

Key facts for TraderTraitor Binance crypto heist

IdentifiersTL-2026-5164
Also known asBinance hot wallet theft 2026
SeverityCRITICAL
First disclosed
Exploitation statusExploited in the wild
Affected productsBinance Binance exchange hot wallet / wallet signing and transaction-authorization infrastructure
AttributionTraderTraitor (high confidence)
Nation-state nexusNorth Korea
MITRE ATT&CK techniquesT1021 Remote Services, T1027 Obfuscated Files or Information, T1036 Masquerading, T1059.004 Command and Scripting Interpreter, T1070 Indicator Removal, T1071 Application Layer Protocol, T1078 Valid Accounts, T1176 Software Extensions, T1195.002 Supply Chain Compromise, T1204.002 Malicious File, T1528 Steal Application Access Token, T1552 Unsecured Credentials and 6 more in the attack flow
MotivationFINANCIAL
Target sectorsfinance, cryptocurrency, technology
Target regionsGlobal
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage for TraderTraitor Binance crypto heist

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5164 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TraderTraitor Fake Job Assignment - Dev Runtime Spawning Shell Downloader (Exploitation)

Detects node/npm/python/bun/deno/git spawning cmd, PowerShell, curl, certutil or script hosts with a URL or encoded payload on a developer endpoint. This is how the TraderTraitor fake recruiter take-home assignment and AI-coding-tool lure executes (T1566.003, T1204.002) in the Binance campaign (TL-2026-5164).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1566.003, T1059.001, T1059.003
  • Data sources: sysmon, microsoft_defender_for_endpoint, windows_process_creation
  • Severity: high
  • Confidence: medium

Splunk SPL

index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(ParentImage="*\\node.exe" OR ParentImage="*\\npm.cmd" OR ParentImage="*\\python.exe" OR ParentImage="*\\pythonw.exe" OR ParentImage="*\\bun.exe" OR ParentImage="*\\deno.exe" OR ParentImage="*\\git.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\curl.exe" OR Image="*\\certutil.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\rundll32.exe")
(CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*-enc*" OR CommandLine="*-EncodedCommand*" OR CommandLine="*DownloadString*" OR CommandLine="*IEX*" OR CommandLine="*-urlcache*" OR CommandLine="*FromBase64String*")
| eval parent=lower(ParentImage), child=lower(Image)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmdline values(ParentCommandLine) as parent_cmdline by host, User, parent, child
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "python.exe", "pythonw.exe", "bun.exe", "deno.exe", "git.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "certutil.exe", "mshta.exe", "wscript.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("http://", "https://", "-enc", "-EncodedCommand", "DownloadString", "IEX", "-urlcache", "FromBase64String")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: TraderTraitor Fake Job Assignment - Dev Runtime Spawning Shell Downloader
id: 3b7e1c52-8a4d-4f1e-9c26-5164a0000001
status: experimental
description: Detects developer runtimes (node, npm, python, bun, deno, git) spawning a shell or download utility with a URL or encoded payload, the execution pattern of TraderTraitor fake job-interview assignments and trojanized AI coding tools (TL-2026-5164).
references:
    - https://therecord.media/binance-cryptocurrency-theft-months-long-campaign-nkorea
    - https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.initial_access
    - attack.t1566.003
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\python.exe'
            - '\pythonw.exe'
            - '\bun.exe'
            - '\deno.exe'
            - '\git.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\curl.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
    selection_cli:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '-enc'
            - '-EncodedCommand'
            - 'DownloadString'
            - 'IEX'
            - '-urlcache'
            - 'FromBase64String'
    condition: all of selection_*
falsepositives:
    - Legitimate build scripts and postinstall hooks that download dependencies via curl or PowerShell
    - Developers bootstrapping toolchains with install scripts
level: high

Known false positives:

  • Legitimate npm postinstall or build scripts that fetch dependencies with curl or PowerShell
  • Developer bootstrap scripts that download toolchains

Tuning notes: Scope to developer and DevOps host groups. Allowlist known build tooling by ParentCommandLine or working directory and internal artifact hosts in the URL. Raise priority when the working directory is Downloads, Desktop or a freshly cloned repository. On macOS and Linux endpoints, port the same parent/child logic to EDR process telemetry.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Masqueraded Conferencing / AI Coding Tool Running From User-Writable Path (Exploitation) · unlock with TL Creds
  • Developer Credential and Token Store Access From Scripting Tools (Post-Exploitation) · unlock with TL Creds
  • Long-Lived Cloud Credential Created For Another IAM Principal (Credential Access) · unlock with TL Creds
  • Browser Launched With Unpacked Extension Sideload (Persistence) · unlock with TL Creds
  • Interactive Exec Into Wallet or Signing Service Containers (Post-Exploitation) · unlock with TL Creds
  • Community-Observed DPRK-Linked C2 Infrastructure and Malware Hashes (C2) · unlock with TL Creds
  • TraderTraitor Anti-Forensics - Event Log Clearing and Shell History Deletion (Post-Exploitation) · unlock with TL Creds
  • TraderTraitor Workstation RDP Fan-Out Lateral Movement (Lateral Movement) · unlock with TL Creds

Indicators of compromise for TraderTraitor Binance crypto heist

As of 2026-11-04, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-5164.

20 indicators of compromise · unlock with TL Creds. Compare plans

How TraderTraitor Binance crypto heist works

On 2026-10-29 attackers drained roughly $6.3-6.4 billion in cryptocurrency from Binance, with most of the value moved in about 20 minutes starting around 20:05 UTC across ten blockchains (The Record cites 12,000 wallets across 11 blockchains and ~40,000 transactions used for laundering; press figures for chain count and total vary). Binance's initial finding was a compromised DevOps engineer's laptop used to reach a service container from which unauthorized withdrawal transactions were submitted; a later update said further investigation found additional points of breach and that the attack was 'not a single one-click action'. Binance stated it found no evidence of a wallet private key leak. A NyxLab executive publicly speculated that one signature gave the attacker a never-expiring full-access token to a hot wallet; this is third-party commentary, not confirmed by Binance.

Per Binance's post-mortem as reported by The Record (2026-11-03), the campaign ran for months: 57 North Korean breach attempts were detected during 2026, with the first compromise in June 2026. Reported initial access vectors include fake recruitment interviews and assignment downloads containing malware, software disguised as an AI coding tool, compromised browser extensions, malicious video-conferencing tools and compromised internal AI tooling. In September 2026 a software engineer was compromised through a fake job assignment. On 2026-10-20 the attackers moved laterally to two additional devices, and on 2026-10-29 they accessed critical wallet tooling, using stolen credentials and the internal wallet signing service and advanced transaction-authorization methods. The malware reportedly evaded endpoint protection and the attackers removed traces of the initial compromise.

Attribution: TRM Labs attributed the theft to TraderTraitor with high confidence and Chainalysis said it was likely TraderTraitor (also tracked as part of the Lazarus Group/APT38 cluster per BleepingComputer). The FBI and other U.S. agencies were reported to blame TraderTraitor. North Korea's Kim Yo Jong called the allegations absurd. Press compares the operation to the February 2025 Bybit theft ($1.5B). Laundering reportedly involved rapid rotation of wallets (about every 25 seconds), sales of USDT to market makers and conversion to ETH/BTC. Response: Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze roughly $2.7-3B (The Record: ~$2.85B); Binance suspended deposits/withdrawals, revoked authorizations, replaced compromised devices and wallets, rotated credentials, tightened device controls and wallet-service risk controls, and committed to cover all losses. Reported figures differ between outlets and should be re-verified against Binance's final post-mortem. No CVEs, file hashes, IP addresses or domains have been published.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1078 Valid Accounts

Execution

T1059.004 Command and Scripting Interpreter; T1204.002 Malicious File; T1609 Container Administration Command; T1610 Deploy Container

Command and Control

T1071 Application Layer Protocol

Persistence

T1176 Software Extensions; T1554 Compromise Host Software Binary

Initial Access

T1195.002 Supply Chain Compromise; T1566.003 Spearphishing via Service

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials

Resource Development

T1585.001 Social Media Accounts

Impact

T1657 Financial Theft

Remediation for TraderTraitor Binance crypto heist

Immediate actions

  • Treat unsolicited recruiter outreach and take-home coding assignments as hostile; run assignment code only in isolated disposable environments
  • Hunt for malicious or unapproved browser extensions, AI coding tools and video-conferencing clients on developer and DevOps endpoints
  • Rotate credentials, tokens and signing authorizations reachable from developer laptops; revoke never-expiring or full-access tokens on hot wallets
  • Review service-container and wallet signing service logs for unauthorized withdrawal requests and anomalous lateral movement between engineer devices

Workarounds

  • Share indicators and destination addresses with blockchain analytics firms and stablecoin issuers to enable rapid freezes

Longer-term hardening

  • Enforce independent multi-party transaction authorization with out-of-band verification for high-value withdrawals
  • Segment developer/DevOps endpoints from wallet signing infrastructure and apply strict device controls
  • Deploy behavioral anomaly detection on wallet services and endpoints, since the malware evaded signature-based endpoint protection
  • Apply withdrawal velocity limits, short-lived scoped tokens and hot-wallet balance caps

Affected and fixed versions

  • Binance — Binance exchange hot wallet / wallet signing and transaction-authorization infrastructure
    Vulnerable versions: Not applicable - operational compromise, no software vulnerability reported

Timeline of TraderTraitor Binance crypto heist

Last updated · 2 updates · revalidated 2× · latest source

  • February 2025 Bybit theft (~$1.5B), previously the largest recorded crypto heist, is cited by press as the precedent for locked-ioc-13 operations.
  • A Binance Wallet DevOps engineer searching for a popular AI coding tool downloads a tampered locked-ioc-19 installation (exact day in June not stated). Binance detects and remediates it and resets credentials, but the attackers learn the wallet team's composition.
  • June 2026: per Binance's post-mortem, the months-long campaign begins with the first compromise (exact day not stated).
  • September 2026: a Binance software engineer is compromised via a fake job-interview assignment containing malware (exact day not stated); 57 North Korean breach attempts were detected across 2026.
  • Attackers move laterally from the compromised engineer's device to two additional devices and harvest credentials.
  • Attacker operator wallet receives three small locked-ioc-15 withdrawals (TRM Labs).
  • Small test deposit made on the Wednesday morning; TRM Labs reports at least 36 hours of rehearsal before the theft, with code tested on three wallets early Thursday.
  • Tether freezes 971.1M USDT (21:01 UTC), Circle 823M USDC (21:04 UTC), Ripple 40.5M RLUSD and World Liberty Financial 27.8M USD1; the locked-ioc-18 Security Council forces transfers at 00:08 UTC on 2026-10-30.
  • At 20:20 UTC 50 EIP-7702 authorizations are submitted on Ethereum; the first sweep follows at 20:23:24 UTC and the final Ethereum transfer (2,961.9 ETH) settles at 23:56 UTC.
  • Using credentials stolen from the first engineer's system, attackers access a third engineer's computer, deploy a container and run a malicious script against wallet signing services; attack code is tested on two wallets, rehearsed on a third and installed on the hot wallet around 16:00 UTC (TRM).
  • Attackers access critical wallet signing/transaction-authorization tooling and drain ~$6.3-6.4B across ten blockchains, mostly within ~20 minutes starting about 20:05 UTC; Binance suspends deposits/withdrawals.
  • The malicious EIP-7702 delegation is cleared about 00:10 UTC (MPC prevented single-key revocation); laundering through Tron addresses begins.
  • TRM Labs (high confidence) and Chainalysis attribute the theft to locked-ioc-13; Tether, Circle, Ripple, World Liberty Financial and the locked-ioc-18 Security Council freeze roughly $2.7-3B. Binance cites a compromised DevOps laptop and later additional breach points.
  • FBI attributes the theft to locked-ioc-13 (per Elliptic); Binance completes a zero-knowledge proof of reserves for its October 31 snapshot.
  • Binance reports 98% of impacted token assets replenished; by 2026-11-03 about $2.85B is frozen or intercepted.
  • Binance begins phased resumption of withdrawals; laundering shifts from Tron to other chains.
  • Binance releases its post-mortem describing the months-long campaign; North Korea (Kim Yo Jong) denies involvement and calls the allegations absurd.

Update history

Sources cited for TraderTraitor Binance crypto heist

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated .

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats