TraderTraitor drained about $6.36 billion from Binance wallets
TRM Labs says most funds left in about 20 minutes on October 29 across ten chains; Binance says user funds are safe.
92
Organization
TRM Labs
- Mentions · 7d11
- Mentions · 30d23
- All mentions35
- First seenSep 10, 2026
- Last mentioned21h ago
Timeline
35 articles · newest firstNorth Korean hackers blamed for record $6.3B Binance crypto theft
Binance says a compromised engineer laptop enabled unauthorized withdrawals and has halted deposits and withdrawals.
92
FBI seizes virtualine.net, domain of bulletproof host Virtualine
TRM Labs ties the host to ransomware and StealC payments and says the seizure may leave infrastructure online.
58
Binance says attackers stole about $6.3 billion in crypto
Binance reports freezing about $3 billion, denies a private-key leak, and says it will cover losses.
92
Binance wallets drained of about $6.3 billion in roughly 20 minutes
Tracing firms suspect North Korea’s TraderTraitor, which Binance has not confirmed; about $2.8 billion, mostly stablecoins, has been frozen.
91
Binance confirms $6.3bn cryptocurrency theft in record heist
The exchange froze about $3bn, paused withdrawals, and says customer funds are covered; three firms blame TraderTraitor.
92
TRM ties $6.36 billion Binance theft to TraderTraitor
Sweeper contracts and EIP-7702 delegations drained hot wallets; about $2.7 billion was later frozen.
93
Binance reports about $6.3 billion stolen in crypto heist
Binance will cover user losses, and close to $3 billion has already been frozen on-chain.
95
Binance loses about $6.3 billion in heist linked to TraderTraitor
TRM tracked $6.36 billion across ten chains in about 20 minutes; roughly $3 billion is frozen and $2.4 billion remains movable.
92
Binance confirms $6.3 billion crypto theft and freezes about half
Assets moved across 20 blockchains in about 20 minutes; Binance says customer losses will be covered.
92
US seizes Virtualine bulletproof hosting domain used by cybercriminals
TRM Labs says the provider took nearly one-fifth of tracked illicit bulletproof-hosting inflows in 2026, and the seizure may not kill the infrastructure.
62
Chinese Phishing Network Uses 17,000 Domains to Target Japanese Banks and Steal Credentials
Chinese-language phishing kits used about 17,000 domains to steal credentials from Japanese bank and retail customers.
78
Microsoft Disrupts CoGUI Phishing Kit Linked to Over 100 Million Malicious Emails a Month
Microsoft and partners seized CoGUI phishing-kit infrastructure tied to over 100 million malicious emails a month.
78
As phishing-as-a-service goes industrial, Microsoft takes down a marketplace behind 1 billion messages
Microsoft dismantled YAM Store, a phishing marketplace tied to more than one billion malicious messages.
82
Microsoft Disrupts 3 Phishing Kits Linked to Over 1 Billion Scam Messages
Microsoft and partners disrupted three phishing kits linked to over one billion scam messages worldwide.
82
U.K. Sanctions Cryptomus for RU Money Laundering
The U.K. sanctioned Cryptomus and related crypto platforms accused of laundering funds tied to Russian cybercrime.
74
Global takedown hits network behind 1 billion phishing messages
Microsoft and police disrupted a phishing marketplace and kits behind more than a billion malicious messages.
82
Microsoft and partners disrupt vast Chinese-language phishing kit ecosystem
Microsoft and partners seized Chinese-language phishing-kit infrastructure that sent more than one billion messages.
83
Microsoft Disrupts Chinese-Language Phishing Market Behind 1B+ Messages
Microsoft seized domains used by YAM Store, CoGUI, and Iron Man after more than one billion phishing messages.
84
Uranium crypto exchange hacker convicted for stealing $53 million
Maryland man Jonathan Spalletta was convicted of stealing $53 million by hacking Uranium Finance in 2021.
55
US sanctions Tren de Aragua gang members in ATM hacks crackdown
Treasury sanctioned eight Tren de Aragua members over ATM jackpotting that stole about $40.7 million.
74
Treasury Sanctions Tren de Aragua ATM Jackpotting Network Linked to $40.7 Million in Losses
US Treasury sanctioned a Tren de Aragua network accused of ATM jackpotting tied to about $40.7 million in losses.
72
Tren de Aragua ATM Jackpotting Network Linked to $40.7 Million in U.S. Losses
The U.S. Treasury sanctioned a Tren de Aragua network tied to $40.7 million in ATM jackpotting losses.
78
Treasury Blacklists Most-Wanted ATM Malware Developer and His Network
US Treasury sanctioned alleged Ploutus ATM-malware developer Anibal Canelon Aguirre and associates tied to Tren de Aragua.
66
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Bitget confirms North Korean-linked attackers stole $387.5M via a zero-day in third-party security appliances, deploying web shells and a custom withdrawal tool.
90
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget says attackers exploited a zero-day in an unnamed third-party security product to steal $388 million from hot and warm wallets.
91
North Korean hackers suspected in $351M crypto theft, the largest so far this year
Suspected North Korean hackers stole about $351 million in crypto from Bitget hot wallets.
88
AI-Powered Phishing Platform EvilTokens Disrupted by Microsoft
Microsoft disrupted EvilTokens, an AI-powered phishing platform that compromised 12,000+ email accounts across 10,000+ organizations.
75
Microsoft disrupts EvilTokens phishing service that gave criminals access to 12,000 inboxes
Microsoft and partners seized EvilTokens infrastructure after the phishing service compromised over 12,000 inboxes.
84
Microsoft Takes Down EvilTokens Device-Code Phishing Service Tied to 12,000 Inbox Compromises
Microsoft dismantled EvilTokens, an AI-assisted device-code phishing service linked to about 12,000 inbox takeovers.
76
Two arrested in UK after Microsoft takedown of ‘Eviltokens’ AI-chatbot for cybercriminals
Microsoft's court-authorized takedown of the EvilTokens AI phishing platform led to two UK arrests; the service had access to 12,000+ compromised inboxes.
58
UK Cops arrest 2 EvilTokens suspects, Microsoft seizes 50 phishing kit websites
UK police arrested two EvilTokens admins as Microsoft seized sites used to phish over 12,000 inboxes.
77
Microsoft and partners disrupt EvilTokens, a comprehensive cybercrime service for financial fraud
Court-ordered seizure of 50 EvilTokens websites disables an AI-driven PhaaS tied to 12,000 compromised Microsoft inboxes and $1.7M reported losses.
74
Treasury urges banks to file cyber scam reports, noting nearly $13 billion in losses since 2023
FinCEN urged banks to report cyber scams after a study found $12.7 billion stolen from US victims of crypto investment scams since 2023.
66
OFAC Sanctions Chinese Scam Platform Xinbi Guarantee
US Treasury's OFAC sanctioned Chinese scam-platform Xinbi Guarantee, which processed $24bn+, and froze $52.8m in linked cryptoassets.
48
Appears with
- Cloudflareorganization · 13
- Microsoftorganization · 13
- Health-ISACorganization · 11
- Microsoftvendor · 10
- Binancevictim · 9
- TraderTraitorthreat actor · 8
- Microsoft 365product · 8
- Oracleorganization · 7
- Proofpointorganization · 7
- Chainalysisorganization · 7
- CoGUImalware · 7
- Resecurityorganization · 7
- OpenAIorganization · 6
- Ellipticorganization · 5
- SpyCloudorganization · 5
- Coinbaseorganization · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.