Binance heist: what we know, and what RL sees in TraderTraitor's toolkit
2026-11-04 • Reversing Labs •
The FBI attributed the October 2026 theft of approximately $6.34 billion from Binance to North Korea's TraderTraitor operation after Binance disclosed a developer-focused intrusion that progressed from malicious software and a fake job interview to compromised wallet-signing infrastructure. ReversingLabs identified a trojanized Terraform provider, the FLATROOF delivery chain, and likely earlier ROOFDECK builds in historical telemetry, including artifacts observed months before public reporting. The toolset hides malicious functionality inside legitimate developer software, steals credentials and session material, and uses encrypted WOFF containers, Telegram, GitHub, webhooks, Nostr, and Pastebin in its delivery and command channels. ReversingLabs did not establish that the analyzed malware samples were used in the Binance breach, preserving a clear boundary between the confirmed incident attribution and the separate malware research.