hacker-news · Crawled Nov 2, 2026

FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist

1 IoCs 1 Actors
Read original article ↗

AI Summary

The FBI has attributed a record $6.43 billion cryptocurrency heist from Binance to TraderTraitor, a North Korea-aligned hacking group also known as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The group used trojanized Terraform providers to deliver a cross-platform malware implant called FLATROOF, which deploys a Python-based information stealer and the ROOFDECK backdoor for persistent remote access. TraderTraitor employs social engineering via fake job lures hosted on tailored domains, using AI to create convincing personas and target individuals in blockchain, AI, and cybersecurity sectors. A portion of the stolen funds has been frozen on-chain by major blockchain platforms.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor TraderTraitor →

Indicators of Compromise 1 extracted

Type Value Detail
Domain spoofed-ai-blockchain-intel[.]com Details →

MITRE ATT&CK TTPs 25 techniques

T1003 OS Credential Dumping · Credential Access T1014 Rootkit · Defense Evasion T1027 Obfuscated Files or Information · Defense Evasion T1055 Process Injection · Defense Evasion T1057 Process Discovery · Discovery T1059.003 Windows Command Shell · Execution T1059.005 Visual Basic · Execution T1071.001 Web Protocols · Command And Control T1078 Valid Accounts · Defense Evasion T1082 System Information Discovery · Discovery T1090 Proxy · Command And Control T1105 Ingress Tool Transfer · Command And Control T1133 External Remote Services · Persistence T1195.002 Compromise Software Supply Chain · Initial Access T1204.002 Malicious File · Execution T1480 Execution Guardrails · Defense Evasion T1484 Domain or Tenant Policy Modification · Defense Evasion T1496 Resource Hijacking · Impact T1543.003 Windows Service · Persistence T1558 Steal or Forge Kerberos Tickets · Credential Access T1566 Phishing · Initial Access T1566.001 Spearphishing Attachment · Initial Access T1573 Encrypted Channel · Command And Control T1574 Hijack Execution Flow · Persistence T1588 Obtain Capabilities · Resource Development