698 reports
The FBI attributed the $6.43 billion Binance hot-wallet theft to North Korea's TraderTraitor activity after attackers used a fake job interview and malicious coding assignment to compromise an engineer, pivot through internal systems, and abuse Binance's …
Security Alliance attributes the approximately $6.4 billion Binance intrusion to DPRK's TraderTraitor and distinguishes the group from Contagious Interview despite both using job-interview lures. TraderTraitor selectively targets engineers with privileged…
OFAC designated ten individuals and the First Financial and Technical Development Center for allegedly supporting overseas IT-worker networks that generated revenue for the North Korean government. SlowMist analyzed eight sanctioned Ethereum and TRON addr…
A fake recruiter induced a Binance engineer to run a take-home assignment whose setup code replaced `pyenv` under `/opt/homebrew`, a pattern SafeDep links to the DPRK-associated Contagious Interview campaign. SafeDep's benign reconstruction showed that pa…
PolySwarm reviews the October 2026 theft of approximately $6.36 billion from Binance, which the FBI and TRM Labs attributed to North Korea's TraderTraitor activity. The analysis describes coordinated transfers across ten blockchains and assessed compromis…
Trellix telemetry for April through September 2026 placed Lazarus among the five most detected APT actors targeting the United States at 5.68%. Lazarus and Kimsuky led the actor rankings for Türkiye at 9.34% and 7.36%, respectively, while Germany recorded…
PolinRider compromised legitimate npm packages and embedded a loader that retrieves command-and-control infrastructure from data encoded in an Ethereum transaction. The loader decodes obfuscated JavaScript, downloads an XOR-obfuscated payload over HTTP, a…
The FBI attributed the October 2026 theft of approximately $6.34 billion from Binance to North Korea's TraderTraitor operation after Binance disclosed a developer-focused intrusion that progressed from malicious software and a fake job interview to compro…
North Korean IT worker teams are moving beyond domestic U.S. laptop farms by transporting employer-issued systems to Pakistan and masking them with U.S. VPN endpoints. Slack discussions also show teams assigning AI-training work, using real residents to p…
Sonatype found Ethereum-based runtime loaders in 12 releases of 10 hijacked npm packages, with execution occurring during module loading or application startup rather than through install hooks. The loaders resolve payload infrastructure through a hard-co…
S2W assesses the October 29 Binance hot-wallet compromise, which resulted in USD 6.3-6.4 billion in losses across at least 10 blockchains, as an operation by the DPRK-backed TraderTraitor group. The report says attackers used EIP-7702 delegated authorizat…
SEAL recorded four DPRK incidents causing $3 million in losses, excluding the separately disclosed Binance incident. Three UNC1069 operations compromised macOS devices and remained dormant for weeks or months before stealing approximately $2.94 million, u…
Kimsuky, also tracked as APT43, continued operating the GitPower campaign through GitHub after public disclosure, with all 25 accounts examined by OctoProbe still online on November 3, 2026. Repositories served as command dead drops, collected system repo…
North Korean attackers allegedly stole approximately USD 6.34 billion from Binance after compromising developer laptops through a tampered Homebrew installation and a malicious fake-interview repository. The malware replaced `pyenv`, while subsequent acce…
Attackers stole an estimated $6.3–$6.43 billion from Binance hot wallets across approximately ten blockchains on October 29, 2026, apparently after compromising internal transaction-signing infrastructure. The FBI attributed the theft to North Korea's Tra…