Binance Confirms $6.34B Heist Traced to TraderTraitor via Fake Job Interview and Compromised Wallet Signing Service
Binance released an updated post-incident report detailing how North Korea-linked TraderTraitor hackers stole $6.34 billion in roughly 20 minutes on October 29, 2026, draining funds across more than 10 blockchains from hot wallets. The intrusion began in June 2026 when an engineer (Engineer A) downloaded a tampered Homebrew installation; information about that engineer was later exposed to the attackers. In September 2026, a second engineer (Engineer B) was targeted via a fake job interview on a legitimate job-hunting platform, culminating in a malicious code repository disguised as a coding assignment that replaced a legitimate development tool component to establish C2 communication. The attackers then pivoted to control Engineer A's wallet and a third engineer's (Engineer C) credentials, ultimately exploiting an internal AI tool and an internal wallet signing service to authorize unauthorized transactions outside normal withdrawal procedures. The FBI publicly attributed the attack to TraderTraitor on October 31, and roughly half the stolen funds have been frozen by industry partners, while the remainder is being laundered by North Korean actors.
Detalhes técnicos
The attack chain combined social engineering (fake job interview, malicious "assignment" repository), supply-chain-style tampering (malicious Homebrew installation, replaced development tool component), credential theft, lateral movement, abuse of an internal AI tool, and ultimately subversion of a wallet signing service to bypass normal withdrawal authorization. Crypto tracing firm Elliptic reports the laundering operation used approximately 12,000 wallets across 11 blockchains and over 40,000 transactions within the first three and a half days — roughly one new wallet every 25 seconds — indicating automated laundering. TRM Labs estimates North Korean hackers have stolen around $12 billion in cryptocurrency since 2017, with more than half occurring in 2026 alone.
Remediação
Binance states it has rebuilt or replaced internal systems impacted in the attack and set aside funds to cover user losses. The company reports it detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026, suggesting heightened internal monitoring against this threat actor.
Linha do tempo
-
Binance Confirms $6.34B Heist Traced to TraderTraitor via Fake Job Interview and Compromised Wallet Signing Service
ler a análise desta fonte ocultar
Binance released an updated post-incident report detailing how North Korea-linked TraderTraitor hackers stole $6.34 billion in roughly 20 minutes on October 29, 2026, draining funds across more than 10 blockchains from hot wallets. The intrusion began in June 2026 when an engineer (Engineer A) downloaded a tampered Homebrew installation; information about that engineer was later exposed to the attackers. In September 2026, a second engineer (Engineer B) was targeted via a fake job interview on a legitimate job-hunting platform, culminating in a malicious code repository disguised as a coding assignment that replaced a legitimate development tool component to establish C2 communication. The attackers then pivoted to control Engineer A's wallet and a third engineer's (Engineer C) credentials, ultimately exploiting an internal AI tool and an internal wallet signing service to authorize unauthorized transactions outside normal withdrawal procedures. The FBI publicly attributed the attack to TraderTraitor on October 31, and roughly half the stolen funds have been frozen by industry partners, while the remainder is being laundered by North Korean actors.
Technical Details
The attack chain combined social engineering (fake job interview, malicious "assignment" repository), supply-chain-style tampering (malicious Homebrew installation, replaced development tool component), credential theft, lateral movement, abuse of an internal AI tool, and ultimately subversion of a wallet signing service to bypass normal withdrawal authorization. Crypto tracing firm Elliptic reports the laundering operation used approximately 12,000 wallets across 11 blockchains and over 40,000 transactions within the first three and a half days — roughly one new wallet every 25 seconds — indicating automated laundering. TRM Labs estimates North Korean hackers have stolen around $12 billion in cryptocurrency since 2017, with more than half occurring in 2026 alone.
Remediation
Binance states it has rebuilt or replaced internal systems impacted in the attack and set aside funds to cover user losses. The company reports it detected and prevented 57 suspected North Korea-linked cyber threat cases throughout 2026, suggesting heightened internal monitoring against this threat actor.