
North Korea launders stolen Binance crypto via fake DeFi tokens
About 117,000 NEAR, valued at $430,000, moved through six disposable NEAR tokens from November 5 to 7.
25 stories, newest first · one card per story

About 117,000 NEAR, valued at $430,000, moved through six disposable NEAR tokens from November 5 to 7.
FBI blames North Korea’s TraderTraitor; Pyongyang denies it, and about $2.85 billion was frozen.

Attackers used a compromised developer laptop and Ethereum delegation to drain $6.3B from Binance hot wallet in 20 minutes.
FBI urges crypto platforms to block TraderTraitor addresses and prevent fund laundering.

On October 29 attackers moved about $6.36 billion from Binance wallets; issuers later froze part of the funds.

The FBI attributed a $6.43 billion cryptocurrency theft to North Korean group TraderTraitor, which used trojanized Terraform and malware like FLATROOF.

FBI links the $6.3 billion theft to the TraderTraitor group, with funds moving through DeFi platforms.

TRM and Chainalysis blame North Korea's TraderTraitor, while Binance says it has not identified who is responsible and will cover losses.

TRM Labs says most funds left in about 20 minutes on October 29 across ten chains; Binance says user funds are safe.

Binance says a compromised engineer laptop enabled unauthorized withdrawals and has halted deposits and withdrawals.
Binance reports freezing about $3 billion, denies a private-key leak, and says it will cover losses.

Tracing firms suspect North Korea’s TraderTraitor, which Binance has not confirmed; about $2.8 billion, mostly stablecoins, has been frozen.

The exchange froze about $3bn, paused withdrawals, and says customer funds are covered; three firms blame TraderTraitor.

TRM and Chainalysis attribute the October 29 theft to North Korea’s TraderTraitor; Binance has not named a culprit.

Binance will cover user losses, and close to $3 billion has already been frozen on-chain.

Binance froze withdrawals, says about $3 billion is frozen on-chain, and pledges to cover the losses.

A trojanized Terraform AWS provider installs FLATROOF and ROOFDECK malware on developer macOS, Linux, and Windows systems.

Suspected North Korean hackers trojanized a Terraform provider to install FLATROOF and ROOFDECK on developer machines.

Suspected TraderTraitor operators trojanized a Terraform provider to deliver the cross-platform FLATROOF backdoor.

ZachXBT says he infiltrated a Chinese syndicate laundering Bybit proceeds for North Korea’s Lazarus Group.

Investigator ZachXBT infiltrated a Chinese laundering syndicate processing $1B+ for Lazarus Group, enabling Tether freezes of stolen Bybit funds.

Bitget says attackers exploited a zero-day in an unnamed third-party security product to steal $388 million from hot and warm wallets.

North Korean TraderTraitor used fake Terraform job tests to plant macOS backdoors and reach cloud accounts.

North Korea-linked TraderTraitor uses weaponized Terraform lock files in fake job-interview GitHub repos to deploy FLATROOF and ROOFDECK macOS backdoors on DevOps engineers.
Today 1.5K readers · 2.4K views · 754 reads · all time 189K views