Binance ties roughly $6.3 billion crypto theft to a laptop
TRM and Chainalysis blame North Korea's TraderTraitor, while Binance says it has not identified who is responsible and will cover losses.
92
Threat actor
Lazarus Group
- Mentions · 7d5
- Mentions · 30d10
- All mentions27
- First seenAug 11, 2026
- Last mentioned7h ago
Timeline
27 articles · newest firstBinance links $6.3 billion crypto theft to compromised laptop
TRM and Chainalysis attribute the October 29 theft to North Korea’s TraderTraitor; Binance has not named a culprit.
93
Binance loses about $6.3 billion in heist linked to TraderTraitor
TRM tracked $6.36 billion across ten chains in about 20 minutes; roughly $3 billion is frozen and $2.4 billion remains movable.
92
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
76
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
Lazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
74
Lazarus uses ML-KEM to deliver malware in FlashHole attacks
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
74
Lazarus Operation FlashHole targets South Korean organizations
Kaspersky links at least three firms in three sectors, with earliest evidence in July 2025.
74
Researcher Infiltrates Chinese Crime Syndicate Laundering Crypto for Lazarus Group
ZachXBT says he infiltrated a Chinese syndicate laundering Bybit proceeds for North Korea’s Lazarus Group.
66
Researcher Infiltrates Lazarus Group’s Crypto Laundering Network After $1.5B Bybit Hack
Investigator ZachXBT infiltrated a Chinese laundering syndicate processing $1B+ for Lazarus Group, enabling Tether freezes of stolen Bybit funds.
62
Crypto CEO accuses North Korea of stealing $387 million from Bitget platform
Bitget says hackers stole $387.5 million and its CEO links the theft to North Korean groups.
83
Bitget Hot Wallet Hacked – Attackers Stole $351.6 Million From Hot Wallets
Bitget confirmed a $351.6 million theft from hot and warm wallets while cold storage stayed secure.
90
North Korean TraderTraitor Hackers Use Fake Terraform Job Tests to Deploy macOS Backdoors
North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.
78
Hackers Weaponize Terraform Lock Files to Infect DevOps Engineers With macOS Backdoors
North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
80
North Korea-linked Hackers Hide a Backdoor Inside HAProxy
Rapid7 reports North Korea-linked hackers implanted a backdoor compiled into HAProxy at South Korean automotive and media firms, enabling covert C2 and credential theft.
60
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
North Korea’s Lazarus Operates Through Six Distinct Cyber Clusters
Sekoia and Kudelski Security reclassify North Korea's Lazarus umbrella into six clusters spanning espionage, financial theft, and fake IT worker operations.
75
New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic
Rapid7 found a new backdoor, ted, compiled into trojanized HAProxy at two South Korean organizations, with medium-confidence attribution to North Korean actors.
65
Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution
Microsoft patched CVE-2026-69836 (CVSS 10.0), a deserialization RCE in Entra ID; the flaw was fully mitigated service-side and was not exploited in the wild.
66
⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More
Weekly recap: suspected China-nexus APT exploited VMware vCenter CVE-2026-59310, Lazarus used Windows zero-day CVE-2026-68820, and macOS flaw dropped Monero miners.
78
Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor
Lazarus exploits Windows AFD.sys zero-day CVE-2026-68820 in Operation Dream Job to deploy Troy backdoor at defense firms.
78
North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring
Researchers expose DPRK remote IT worker infiltration tactics, including forged identities and AI-assisted interview behavior.
48
North Korean Lazarus Group Uses Windows Zero
Check Point links Lazarus Group's Operation Dream Job to a new Windows zero-day, CVE-2026-68820, targeting defense workers with fake Lockheed Martin job offers.
84
Lazarus Used Post-Quantum Key Exchange to Deliver Zero-Day
Lazarus used a post-quantum key exchange to shield delivery of a Windows zero-day exploit, adding stealth to its campaign.
72
Microsoft’s massive Patch Tuesday releases continue as AI reshapes bug discovery
Microsoft patches 419 vulnerabilities in record-breaking Patch Tuesday; Windows Winsock zero-day CVE-2026-68820 is actively exploited by Lazarus Group.
80
CISA gives federal agencies two weeks to patch Microsoft bug exploited in DPRK campaign
CISA orders federal agencies to patch exploited Windows Winsock zero-day CVE-2026-68820 by August 25, used by Lazarus in Operation Dream Job.
82
Researchers Built a Fake Crypto Startup and Hired Three Suspected North Korean IT Workers
Security researchers hired three suspected North Korean IT workers at a fake DeFi startup, documenting forged IDs, AI-edited images and post-hire system access.
55
Related CVEs
by mentions- CVE-2026-68820<1%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2025-4911399%8.8Authenticated PHP Object Deserialization RCE in Roundcube Webmail
- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-654002%9.8Authentication Bypass in Apple macOS Screen Sharing
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-593103%9.8Unauthenticated Path Traversal RCE in Broadcom VMware vCenter Server Syslog
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-698362%10.0Unauthenticated Deserialization RCE in Microsoft Entra ID
Appears with
- Microsoftvendor · 7
- Windowsproduct · 6
- TraderTraitorthreat actor · 6
- Tetherorganization · 5
- Check Pointvendor · 4
- FBIorganization · 4
- INISAFE CrossWeb EXproduct · 4
- Kasperskyorganization · 4
- Circleorganization · 3
- Troyproduct · 3
- Jade Sleetthreat actor · 3
- TechHubmalware · 3
- Binancevictim · 3
- Troymalware · 3
- Check Point Researchorganization · 3
- ForestTigermalware · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.