# TraderTraitor (North Korea) months-long campaign leads to $6.34B Binance cryptocurrency theft

> Binance disclosed that a months-long campaign attributed by TRM Labs, Chainalysis and U.S. agencies to North Korea's TraderTraitor unit led to the theft of roughly $6.3-6.4 billion in crypto on 2026-10-29, the largest recorded crypto heist. Reported access vectors include a fake job-interview assignment and malware disguised as an AI coding tool, followed by lateral movement, credential theft and abuse of internal wallet signing/transaction-authorization tooling; North Korea denies responsibility.

- **Published:** 2026-11-03T17:08:18Z
- **Last reviewed:** 2026-11-04T10:59:40.655Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5164
- **ID:** TL-2026-5164
- **Severity:** CRITICAL
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** TraderTraitor (North Korea)
- **Detections:** 9 (1 shown free below) · **IOCs:** 20

## Description

On 2026-10-29 attackers drained roughly $6.3-6.4 billion in cryptocurrency from Binance, with most of the value moved in about 20 minutes starting around 20:05 UTC across ten blockchains (The Record cites 12,000 wallets across 11 blockchains and ~40,000 transactions used for laundering; press figures for chain count and total vary). Binance's initial finding was a compromised DevOps engineer's laptop used to reach a service container from which unauthorized withdrawal transactions were submitted; a later update said further investigation found additional points of breach and that the attack was 'not a single one-click action'. Binance stated it found no evidence of a wallet private key leak. A NyxLab executive publicly speculated that one signature gave the attacker a never-expiring full-access token to a hot wallet; this is third-party commentary, not confirmed by Binance.

Per Binance's post-mortem as reported by The Record (2026-11-03), the campaign ran for months: 57 North Korean breach attempts were detected during 2026, with the first compromise in June 2026. Reported initial access vectors include fake recruitment interviews and assignment downloads containing malware, software disguised as an AI coding tool, compromised browser extensions, malicious video-conferencing tools and compromised internal AI tooling. In September 2026 a software engineer was compromised through a fake job assignment. On 2026-10-20 the attackers moved laterally to two additional devices, and on 2026-10-29 they accessed critical wallet tooling, using stolen credentials and the internal wallet signing service and advanced transaction-authorization methods. The malware reportedly evaded endpoint protection and the attackers removed traces of the initial compromise.

Attribution: TRM Labs attributed the theft to TraderTraitor with high confidence and Chainalysis said it was likely TraderTraitor (also tracked as part of the Lazarus Group/APT38 cluster per BleepingComputer). The FBI and other U.S. agencies were reported to blame TraderTraitor. North Korea's Kim Yo Jong called the allegations absurd. Press compares the operation to the February 2025 Bybit theft ($1.5B). Laundering reportedly involved rapid rotation of wallets (about every 25 seconds), sales of USDT to market makers and conversion to ETH/BTC. Response: Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council froze roughly $2.7-3B (The Record: ~$2.85B); Binance suspended deposits/withdrawals, revoked authorizations, replaced compromised devices and wallets, rotated credentials, tightened device controls and wallet-service risk controls, and committed to cover all losses. Reported figures differ between outlets and should be re-verified against Binance's final post-mortem. No CVEs, file hashes, IP addresses or domains have been published.

## MITRE ATT&CK

- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1176 Software Extensions
- T1036 Masquerading
- T1078 Valid Accounts
- T1528 Steal Application Access Token
- T1021 Remote Services
- T1657 Financial Theft
- T1059.004 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1027 Obfuscated Files or Information
- T1070 Indicator Removal
- T1609 Container Administration Command
- T1585.001 Social Media Accounts
- T1195.002 Supply Chain Compromise
- T1610 Deploy Container
- T1552 Unsecured Credentials
- T1071 Application Layer Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TraderTraitor Fake Job Assignment - Dev Runtime Spawning Shell Downloader (Exploitation)** (`TL-2026-5164-SPL-001`)

Detects node/npm/python/bun/deno/git spawning cmd, PowerShell, curl, certutil or script hosts with a URL or encoded payload on a developer endpoint. This is how the TraderTraitor fake recruiter take-home assignment and AI-coding-tool lure executes (T1566.003, T1204.002) in the Binance campaign (TL-2026-5164).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1566.003, T1059.001, T1059.003
- **Data sources:** sysmon, microsoft_defender_for_endpoint, windows_process_creation
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=endpoint sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(ParentImage="*\\node.exe" OR ParentImage="*\\npm.cmd" OR ParentImage="*\\python.exe" OR ParentImage="*\\pythonw.exe" OR ParentImage="*\\bun.exe" OR ParentImage="*\\deno.exe" OR ParentImage="*\\git.exe")
(Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\curl.exe" OR Image="*\\certutil.exe" OR Image="*\\mshta.exe" OR Image="*\\wscript.exe" OR Image="*\\rundll32.exe")
(CommandLine="*http://*" OR CommandLine="*https://*" OR CommandLine="*-enc*" OR CommandLine="*-EncodedCommand*" OR CommandLine="*DownloadString*" OR CommandLine="*IEX*" OR CommandLine="*-urlcache*" OR CommandLine="*FromBase64String*")
| eval parent=lower(ParentImage), child=lower(Image)
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as child_cmdline values(ParentCommandLine) as parent_cmdline by host, User, parent, child
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("node.exe", "npm.cmd", "python.exe", "pythonw.exe", "bun.exe", "deno.exe", "git.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "curl.exe", "certutil.exe", "mshta.exe", "wscript.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("http://", "https://", "-enc", "-EncodedCommand", "DownloadString", "IEX", "-urlcache", "FromBase64String")
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: TraderTraitor Fake Job Assignment - Dev Runtime Spawning Shell Downloader
id: 3b7e1c52-8a4d-4f1e-9c26-5164a0000001
status: experimental
description: Detects developer runtimes (node, npm, python, bun, deno, git) spawning a shell or download utility with a URL or encoded payload, the execution pattern of TraderTraitor fake job-interview assignments and trojanized AI coding tools (TL-2026-5164).
references:
    - https://therecord.media/binance-cryptocurrency-theft-months-long-campaign-nkorea
    - https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.initial_access
    - attack.t1566.003
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
    - attack.t1059.003
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\node.exe'
            - '\npm.cmd'
            - '\python.exe'
            - '\pythonw.exe'
            - '\bun.exe'
            - '\deno.exe'
            - '\git.exe'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\curl.exe'
            - '\certutil.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
    selection_cli:
        CommandLine|contains:
            - 'http://'
            - 'https://'
            - '-enc'
            - '-EncodedCommand'
            - 'DownloadString'
            - 'IEX'
            - '-urlcache'
            - 'FromBase64String'
    condition: all of selection_*
falsepositives:
    - Legitimate build scripts and postinstall hooks that download dependencies via curl or PowerShell
    - Developers bootstrapping toolchains with install scripts
level: high
```

**Known false positives:**

- Legitimate npm postinstall or build scripts that fetch dependencies with curl or PowerShell
- Developer bootstrap scripts that download toolchains

**Tuning notes:** Scope to developer and DevOps host groups. Allowlist known build tooling by ParentCommandLine or working directory and internal artifact hosts in the URL. Raise priority when the working directory is Downloads, Desktop or a freshly cloned repository. On macOS and Linux endpoints, port the same parent/child logic to EDR process telemetry.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Masqueraded Conferencing / AI Coding Tool Running From User-Writable Path (Exploitation) (locked: unlock with TL Creds)
- Developer Credential and Token Store Access From Scripting Tools (Post-Exploitation) (locked: unlock with TL Creds)
- Long-Lived Cloud Credential Created For Another IAM Principal (Credential Access) (locked: unlock with TL Creds)
- Browser Launched With Unpacked Extension Sideload (Persistence) (locked: unlock with TL Creds)
- Interactive Exec Into Wallet or Signing Service Containers (Post-Exploitation) (locked: unlock with TL Creds)
- Community-Observed DPRK-Linked C2 Infrastructure and Malware Hashes (C2) (locked: unlock with TL Creds)
- TraderTraitor Anti-Forensics - Event Log Clearing and Shell History Deletion (Post-Exploitation) (locked: unlock with TL Creds)
- TraderTraitor Workstation RDP Fan-Out Lateral Movement (Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Binance CEO says 'months-long campaign' led to $6.3 billion theft as N. Korea denies responsibility](https://therecord.media/binance-cryptocurrency-theft-months-long-campaign-nkorea)
- [North Korea linked to $6.3 billion hack on Binance, blockchain intelligence firms say](https://www.hawaiinewsnow.com/2026/10/30/north-korea-linked-63-billion-hack-binance-blockchain-intelligence-firms-say/)
- [Binance links $6.3 billion crypto theft to compromised DevOps laptop](https://www.bleepingcomputer.com/news/security/binance-links-63-billion-crypto-theft-to-compromised-devops-laptop/)
- [$6 billion Binance hack bears hallmarks of North Korea's TraderTraitor](https://securityweek.com/6-billion-binance-hack-bears-hallmarks-of-north-koreas-tradertraitor)
- [Binance hack: $6.3B theft may trace to engineer's laptop](https://www.bitdefender.com/en-au/blog/hotforsecurity/binance-hack-6-3-billion-laptop-breach)
- [Hackers steal $6.3B from Binance in biggest ever crypto heist](https://siliconangle.com/2026/10/30/hackers-steal-6-3b-from-binance-in-biggest-ever-crypto-heist/)
- [The Binance hack explained: how much was stolen, who's behind it and was a single laptop to blame](https://www.itpro.com/security/cyber-attacks/the-binance-hack-explained-how-much-cryptocurrency-was-stolen-whos-behind-the-attack-and-was-a-single-compromised-laptop-to-blame)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5164