Binance ties roughly $6.3 billion crypto theft to a laptop
TRM and Chainalysis blame North Korea's TraderTraitor, while Binance says it has not identified who is responsible and will cover losses.
92
Country
North Korea
- Mentions · 7d24
- Mentions · 30d53
- All mentions121
- First seenAug 11, 2026
- Last mentioned1d ago
Timeline
121 articles · newest firstTraderTraitor drained about $6.36 billion from Binance wallets
TRM Labs says most funds left in about 20 minutes on October 29 across ten chains; Binance says user funds are safe.
92
DeceptiveDevelopment poisons repos after stealing developer credentials
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
76
Defense contractor pleads guilty in North Korea remote-job scheme
John Allen Kurrle Jr. faces up to 20 years; sentencing is set for January 28, 2027, with restitution of about $7,000.
48
North Korean hackers blamed for record $6.3B Binance crypto theft
Binance says a compromised engineer laptop enabled unauthorized withdrawals and has halted deposits and withdrawals.
92
Binance says attackers stole about $6.3 billion in crypto
Binance reports freezing about $3 billion, denies a private-key leak, and says it will cover losses.
92
Binance wallets drained of about $6.3 billion in roughly 20 minutes
Tracing firms suspect North Korea’s TraderTraitor, which Binance has not confirmed; about $2.8 billion, mostly stablecoins, has been frozen.
91
Binance confirms $6.3bn cryptocurrency theft in record heist
The exchange froze about $3bn, paused withdrawals, and says customer funds are covered; three firms blame TraderTraitor.
92
Binance links $6.3 billion crypto theft to compromised laptop
TRM and Chainalysis attribute the October 29 theft to North Korea’s TraderTraitor; Binance has not named a culprit.
93
TRM ties $6.36 billion Binance theft to TraderTraitor
Sweeper contracts and EIP-7702 delegations drained hot wallets; about $2.7 billion was later frozen.
93
Binance reports about $6.3 billion stolen in crypto heist
Binance will cover user losses, and close to $3 billion has already been frozen on-chain.
95
Binance loses about $6.3 billion in heist linked to TraderTraitor
TRM tracked $6.36 billion across ten chains in about 20 minutes; roughly $3 billion is frozen and $2.4 billion remains movable.
92
Binance reports $6.3 billion crypto theft blamed on North Korea
Binance froze withdrawals, says about $3 billion is frozen on-chain, and pledges to cover the losses.
90
Binance confirms $6.3 billion crypto theft and freezes about half
Assets moved across 20 blockchains in about 20 minutes; Binance says customer losses will be covered.
92
North Korean actors use AI to scale social engineering and malware
Microsoft rates Jade Sleet, Coral Sleet, and Jasper Sleet as operationalized; operations remain human-directed, not autonomous.
74
US sanctions Russians and North Koreans over IT-worker laundering
Treasury says two Russians each moved about $3.5 million in crypto tied to North Korean IT workers in Russia.
64
ESET: GhostWriter wiper hit a Ukrainian manufacturer
ESET calls the late-May attack the first destructive Belarus-aligned operation it has documented in Europe and says intent is unclear.
74
Post examines fraudulent North Korean IT worker schemes
The captured page is site boilerplate, so the study’s methods, cases, and findings are not available here.
14
ESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
ASD chief warns AI will drive more disruptive cyberattacks
The annual report also covers an Amadey network of 180,000 computers and ASD wiping about 4.8 million stolen files.
62
Lazarus abuses INISAFE CrossWeb EX in Operation FlashHole
Kaspersky says at least three South Korean firms were targeted since July 2025 via spear-phishing and in-memory loaders.
76
CISA adds exploited PHP2Shell flaws to its KEV catalog
Unauthenticated HTTP requests can run code on PHP engines dating to PHP 5.4; agencies must fix by October 29, 2026.
88
Rapid7 says 71% of tracked exploitation starts within a week
Across 43 newly exploited high- and critical-severity flaws, disclosure-to-exploitation averaged three days.
54
PHP2Shell exploited at a European government entity, Unit 42 says
Within two hours the attackers reached password hashes, MFA secrets, and an NTLM-relay path toward Domain Admin.
86
DDoS waves took North Korean state websites offline for about 32 hours
Kentik tied failures starting October 20 to traffic from Vietnam, Venezuela and elsewhere, but named no operator.
48
DDoS waves knock more than 40 North Korean websites offline
Kentik tied October 20 outages to synchronized traffic from Vietnam, the Philippines and Venezuela; no perpetrator was identified.
52
FBI raids Texas laptop farms tied to North Korean IT schemes
Operation Lonestar Roundup seized 187 devices, charged 14 people, and affected more than 70 US companies, the FBI says.
62
House bill would direct NIST guidance on AI distillation attacks
The AI Cyber Defense Act covers entities tied to Russia, China, Iran, and North Korea and would add an industry roundtable.
54
Lazarus uses ML-KEM-1024 to hide payloads in Operation FlashHole
Securelist says at least three South Korean organizations were hit, with the earliest evidence in July 2025.
74
Lazarus hid FlashHole malware traffic with post-quantum keys
Kaspersky ties July 2025 activity to at least three South Korean organizations and an LPEClient build using ML-KEM-1024.
74
Lazarus uses ML-KEM to deliver malware in FlashHole attacks
Kaspersky says phishing led to in-memory loaders and the Cubridge backdoor at South Korean firms, starting in July 2025.
74
Lawmakers say Russia seeks to undermine Democrats before midterms
They say a classified assessment finds influence activity by Russia, China, Iran, and North Korea, but no vote-system hacking.
44
Rapid7: high-severity flaws exploited within three days in Q3
The Gentlemen and Qilin led claimed ransomware incidents, the US accounted for 60% of attacks, and AI was operational in 8%.
56
MITRE ATT&CK v20 adds AI abuse, MFA bypass, and utility attacks
Enterprise gains nine entries, ICS adds two campaigns plus analytics, and Mobile restores sideloading and NGate.
61
North Korean IT Workers Used Stolen US Identities to Earn $3 Million
FBI raided Texas laptop farms as DOJ charged US facilitators of North Korean IT workers who earned $3 million from over 70 companies.
74
Malware evasion made easier with AI — but behavior still gives it away
ReversingLabs says Midnight Blizzard’s AI-rebuilt backdoor kept the same detectable behavior across five variants.
56
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
58
FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested
FBI raided Texas laptop farms, arrested two Americans, and charged people tied to DPRK IT-worker schemes.
74
U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud
U.S. prosecutors charged 14 people and seized laptop farms used in a North Korean remote IT-worker fraud scheme.
76
FBI raids 40+ laptop farms helping North Korea pocket US tech salaries
FBI arrested two Americans and raided 40-plus laptop farms aiding North Korean IT-worker salary fraud.
76
Related CVEs
by mentions- CVE-2026-688209%7.0Use-After-Free Local Privilege Escalation in Microsoft Windows WinSock AFD Driver
- CVE-2025-4911399%8.8Authenticated PHP Object Deserialization RCE in Roundcube Webmail
- CVE-2026-2276914%10.0Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access
- CVE-2026-109619100%9.2Use-after-free RCE in PHP via stale request globals
- CVE-2026-109618100%9.2OOM longjmp memory flaw enabling RCE in PHP
- CVE-2021-2155180%7.8Local Privilege Escalation in Dell dbutil_2_3.sys Driver
- CVE-2026-6368810.0Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server
- CVE-2026-6369210.0Unauthenticated Privilege Escalation in Dell Container Storage Modules (<1.18.0)
- Path Traversal to Root Code Execution in Dell System Update before 2.3.0.0
Appears with
- Lazarus Groupthreat actor · 22
- FBIorganization · 19
- TraderTraitorthreat actor · 17
- Famous Chollimathreat actor · 12
- Binancevictim · 12
- Microsoftvendor · 12
- Chainalysisorganization · 10
- WaterPlumthreat actor · 10
- TRM Labsorganization · 10
- CrowdStrikeorganization · 9
- Mandiantorganization · 9
- Lazarusthreat actor · 9
- npmproduct · 9
- Bitgetvictim · 9
- Microsoftorganization · 8
- Bitgetorganization · 8
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.