Skip to content
Threat Feed
Subscribe
critical threat

TraderTraitor: Large-scale cryptocurrency theft targeting Binance

The North Korean-aligned actor TraderTraitor (UNC4899) stole $6.43 billion from Binance using recruitment-themed social engineering and trojanized Terraform providers to deploy multi-stage cross-platform malware.

Triage facts

Revision 1
Applicability
Binance, Terraform
Evidence
Unknown
Severity
Critical
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 1, 08:57 UTC
Source quality
A1Almost certain

The U.S. Federal Bureau of Investigation (FBI) has attributed a record $6.43 billion cryptocurrency theft from Binance to the North Korea-aligned threat actor TraderTraitor (also known as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899). The threat actor is known to target individuals in the cybersecurity, AI, and blockchain industries using AI-generated personas and job-themed lures. The group leverages trojanized Terraform providers to deliver a Bash loader, which subsequently installs the FLATROOF cross-platform implant and the ROOFDECK backdoor.

Attack Chain

  1. Reconnaissance: The actor identifies targets in the cybersecurity, AI, and blockchain sectors.
  2. Social Engineering: The actor poses as recruiters using AI-generated personas and industry-specific knowledge to schedule interviews via spoofed front companies.
  3. Delivery: The target is convinced to download or interact with malicious resources, including trojanized Terraform providers.
  4. Execution: The Terraform provider executes a Bash loader script.
  5. Staging: The loader identifies the victim's OS and downloads the appropriate implant (FLATROOF).
  6. Persistence & Control: The FLATROOF implant exfiltrates data and drops the ROOFDECK backdoor to establish remote command and control.
  7. Exploitation: The actor utilizes the compromised environment to facilitate the theft and subsequent laundering of virtual assets.

Impact

  • Over $6.43 billion in virtual assets stolen from Binance, the largest cryptocurrency theft in history.
  • Approximately $2.85 billion in stolen assets has been frozen on-chain by various entities including Tether, Circle, Ripple, Arbitrum, and Optimism.

Recommendation

  • Implement strict code review processes for any third-party infrastructure-as-code (IaC) modules, specifically Terraform providers.
  • Audit outbound network connections from build servers and developer workstations to prevent unexpected downloads of loaders from untrusted external sources.
  • Implement endpoint security monitoring to detect the execution of suspicious Bash scripts, Python information stealers, and the specific artifacts associated with FLATROOF and ROOFDECK implants.
  • Review recruitment and hiring practices to verify the identity of external recruiters and the legitimacy of job opportunities offered via social media or professional networks.

Immediate actions

Audit environment for the use of non-official or unvetted Terraform providers.

IT Operations 48h

Threat Hunt

Hunt for suspicious Bash execution originating from Terraform-related processes or directories.

T1059.004 high high confidence hunt now

Data: Process creation logs, Command line arguments

Mitigations

Implement allow-listing for Terraform providers and disable dynamic loading of providers from untrusted registries.

immediate IT Operations

Terraform supply chain compromise