Binance heist: what we know, and what we see in TraderTraitor's toolkit

In October 2026, attackers linked to North Korea's TraderTraitor operation stole approximately $6.34 billion from Binance through a sophisticated multi-stage supply chain compromise. The attack began with a fake job interview that tricked engineers into downloading trojanized developer tools, including a weaponized Terraform provider. Malicious backdoors named FLATROOF and ROOFDECK were embedded within legitimate-looking developer software, enabling lateral movement from compromised developer workstations to Binance's wallet signing infrastructure. ReversingLabs detected these malicious components 77 days before public disclosure, highlighting the advanced nature of the threat targeting DevOps environments.

• Don't Call Us, We'll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto TiesMalware2026-09-19
• North Korea's Crypto Heists Start on the Open InternetMalware2026-10-31
• Suspected TraderTraitor Group Uses Trojanized Terraform Provider to Deliver Cross-Platform MalwareMalware2026-10-08
• 19 Chrome and Edge Extensions Deliver a Wallet Drainer and Credential-Stealing PayloadsCampaign2026-08-27
• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05