FBI attributes record $6.43B Binance crypto heist to North Korea's TraderTraitor (Jade Sleet)
The FBI, together with the U.S. Secret Service and IRS-CI, has attributed the theft of more than $6 billion in virtual assets, reported as a $6.43 billion Binance heist, to TraderTraitor (also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899), a North Korea-aligned group. It is the largest cryptocurrency theft on record, surpassing the $1.46 billion Bybit theft of February 2025. The funds were taken across 11 blockchains, 82% of them on Ethereum and Bitcoin, and the actor is converting them primarily into ETH ahead of further laundering through DeFi and instant swap services. Of the total, $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Binance has resumed phase one of withdrawals, and deposits were not affected.
Detalhes técnicos
- The article does not state how Binance was compromised. It describes TraderTraitor's recent tradecraft as reported by SentinelOne, Zscaler ThreatLabz and Microsoft.
- Trojanized Terraform providers deliver a Bash loader that selects and downloads malware matching the victim's OS (macOS, Linux, Windows). This includes the cross-platform implant FLATROOF, which uses a Python-based information stealer and finally drops the ROOFDECK backdoor for full remote control.
- Recruitment-themed social engineering uses front companies, tailored domains and social media profiles to pose as recruiters for a spoofed AI-powered blockchain intelligence company, targeting people in cybersecurity, AI, blockchain and talent recruitment. AI is used to craft lures and fake personas and to evade detection.
- The group has been active since at least 2020 and has been linked to the DMM Bitcoin, Bybit, KelpDAO and Bitget thefts.
- The FBI published a list of wallet addresses used for laundering; the article does not reproduce them.
- Elliptic estimates DPRK-linked actors have stolen over $6.5 billion in cryptoassets in recent years.
Remediação
- The article gives no explicit remediation. Defenders can use the FBI-published wallet list for blocking and monitoring, and should treat unsolicited job-themed outreach and third-party Terraform providers as untrusted.
Linha do tempo
-
FBI attributes record $6.43B Binance crypto heist to North Korea's TraderTraitor (Jade Sleet)
ler a análise desta fonte ocultar
The FBI, together with the U.S. Secret Service and IRS-CI, has attributed the theft of more than $6 billion in virtual assets, reported as a $6.43 billion Binance heist, to TraderTraitor (also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899), a North Korea-aligned group. It is the largest cryptocurrency theft on record, surpassing the $1.46 billion Bybit theft of February 2025. The funds were taken across 11 blockchains, 82% of them on Ethereum and Bitcoin, and the actor is converting them primarily into ETH ahead of further laundering through DeFi and instant swap services. Of the total, $2.85 billion has been frozen on-chain by Tether, Circle, Ripple, Arbitrum and Optimism. Binance has resumed phase one of withdrawals, and deposits were not affected.
Technical Details
- The article does not state how Binance was compromised. It describes TraderTraitor's recent tradecraft as reported by SentinelOne, Zscaler ThreatLabz and Microsoft.
- Trojanized Terraform providers deliver a Bash loader that selects and downloads malware matching the victim's OS (macOS, Linux, Windows). This includes the cross-platform implant FLATROOF, which uses a Python-based information stealer and finally drops the ROOFDECK backdoor for full remote control.
- Recruitment-themed social engineering uses front companies, tailored domains and social media profiles to pose as recruiters for a spoofed AI-powered blockchain intelligence company, targeting people in cybersecurity, AI, blockchain and talent recruitment. AI is used to craft lures and fake personas and to evade detection.
- The group has been active since at least 2020 and has been linked to the DMM Bitcoin, Bybit, KelpDAO and Bitget thefts.
- The FBI published a list of wallet addresses used for laundering; the article does not reproduce them.
- Elliptic estimates DPRK-linked actors have stolen over $6.5 billion in cryptoassets in recent years.
Remediation
- The article gives no explicit remediation. Defenders can use the FBI-published wallet list for blocking and monitoring, and should treat unsolicited job-themed outreach and third-party Terraform providers as untrusted.