698 reports
TRM attributes the October 29 Binance theft to the North Korean state-sponsored TraderTraitor unit with high confidence, although no government had publicly attributed the incident. Investigators traced stolen proceeds through self-minted tokens and liqui…
THORChain restored swaps for Bitcoin, Ethereum, Tron and several other networks after an Ethereum reorganization had halted activity and delayed movement of funds stolen from Binance by North Korean hackers. Pangolin Intelligence founder Jonty argued that…
North Korea's Contagious Interview operations used social engineering to direct cryptocurrency, fintech, and Web3 developers to malicious coding-challenge repositories whose loaders contacted short-lived serverless infrastructure. VirusTotal missed 20 of …
SomaXBT analyzed 47,644 transactions from wallets handling funds stolen in the USD 6.36 billion Binance hack and assessed about 54% as clearly automated from their timing and repeated transaction settings. In one November 3 wave, an FBI-listed Solana wall…
DPRK operators compromised a Binance employee through a fictitious recruitment process, delivering malicious code in an interview assignment before using the resulting foothold and access to an internal AI tool to penetrate the exchange. Chainalysis attri…
North Korean attackers compromised Binance through a multi-stage campaign that began with a tampered Homebrew installation and a fake recruitment assignment that executed malware on an engineer’s work computer. The intruders later abused a compromised int…
An attacker force-pushed a forged commit into the legitimate antd-img-crop GitHub repository, adding a build hook that installed the cross-platform OverLord credential stealer and remote-access agent. The same payload was distributed through a fake Amber …
Elliptic says the TraderTraitor-linked theft of USD 6.43 billion from Binance was followed by automated laundering across about 12,000 wallets, 11 blockchains, and more than 40,000 transactions in under four days. The activity centered on splitting Tron f…
Polytrop’s live Binance Hack case page tracks USD 6.3 billion in stolen funds across Bitcoin, TRON, EVM chains, and Solana. As of November 4, it listed 3,848 source addresses, 3,578 downstream addresses across nine hops, and USD 1.712 billion in first tra…
SomaXBT traced approximately $242 million laundered through the Tron portion of the Binance exploit during its first two days, after Tether froze 378.7 million USDT from the $628 million stolen on Tron. The attackers routed funds mainly through Relay, THO…
The FBI attributed the theft of more than $6 billion in virtual assets from Binance on or about October 29, 2026, to North Korea and labeled the activity TraderTraitor. The FBI, USSS, and IRS-CI observed the actors converting stolen assets primarily into …
Bitquery estimates that hurried swaps by the Binance attacker on 29–30 October produced $119 million in losses against market prices. The analysis attributes $59.9 million after costs to traders and arbitrage bots, and $29.5 million in tips to Ethereum bl…
The FBI attributed the October 29 theft of approximately $6.3 billion from Binance to North Korea's TraderTraitor group after attacker-controlled requests caused 17 Binance hot wallets to sign transfers across nine blockchains. Binance said a compromised …
TRM Labs attributed the approximately $6.36 billion theft from Binance to North Korea’s TraderTraitor group with high confidence, while Binance continued working with law enforcement to identify the perpetrator. Binance’s initial investigation indicated t…
TRM estimates that North Korea-backed hackers have stolen USD 12.8 billion in cryptocurrency since 2017, including USD 7.4 billion in 2026. It attributes the October 29 Binance theft of approximately USD 6.36 billion to the North Korean state-sponsored Tr…