Threat video1:00
TraderTraitor Binance Homebrew Lure: Detection & IOCs
A tampered Homebrew installer opened TraderTraitor's path to the $6.3B Binance heist. Get 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for TraderTraitor Binance Homebrew Lure: Detection & IOCs →
Chapters
- 0:00The hookAbout $6.3B stolen from Binance.
- 0:04The storyJune: an engineer downloaded a tampered Homebrew.
- 0:11Attack pathBinance reported a tampered installer, then stealer malware.
- 0:28AttributionAttributed to TraderTraitor.
- 0:32Indicators of compromise2 indicators to hunt: 1 domain and 1 path.
- 0:38MITRE ATT&CK techniques12 ATT&CK techniques, from initial access to impact.
- 0:43Remediation5 steps now: Block and audit developer installs of Homebrew and AI coding.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About $6.3B stolen from Binance.
0:05June: an engineer downloaded a tampered Homebrew.
0:08Then a fake interview lured another.
0:11Binance reported a tampered installer, then stealer malware.
0:15Small Tornado Cash withdrawals funded the operator wallet.
0:19Tested first, then installed on the hot wallet.
0:22Ethereum was swept in minutes; other chains drained.
0:28Attributed to TraderTraitor. Confidence: high.
0:332 indicators to hunt: 1 domain and 1 path.
0:3812 ATT&CK techniques, from initial access to impact.
0:435 steps now: Block and audit developer installs of Homebrew and AI coding.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.