{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/binance/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["TraderTraitor"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Binance","Terraform"],"_cs_severities":["critical"],"_cs_tags":["cryptocurrency","financial-crime","nation-state","social-engineering","supply-chain"],"_cs_type":"threat","_cs_vendors":["Binance","HashiCorp"],"content_html":"\u003cp\u003eThe U.S. Federal Bureau of Investigation (FBI) has attributed a record $6.43 billion cryptocurrency theft from Binance to the North Korea-aligned threat actor TraderTraitor (also known as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899). The threat actor is known to target individuals in the cybersecurity, AI, and blockchain industries using AI-generated personas and job-themed lures. The group leverages trojanized Terraform providers to deliver a Bash loader, which subsequently installs the FLATROOF cross-platform implant and the ROOFDECK backdoor.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eReconnaissance:\u003c/strong\u003e The actor identifies targets in the cybersecurity, AI, and blockchain sectors.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eSocial Engineering:\u003c/strong\u003e The actor poses as recruiters using AI-generated personas and industry-specific knowledge to schedule interviews via spoofed front companies.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDelivery:\u003c/strong\u003e The target is convinced to download or interact with malicious resources, including trojanized Terraform providers.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExecution:\u003c/strong\u003e The Terraform provider executes a Bash loader script.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eStaging:\u003c/strong\u003e The loader identifies the victim's OS and downloads the appropriate implant (FLATROOF).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePersistence \u0026amp; Control:\u003c/strong\u003e The FLATROOF implant exfiltrates data and drops the ROOFDECK backdoor to establish remote command and control.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eExploitation:\u003c/strong\u003e The actor utilizes the compromised environment to facilitate the theft and subsequent laundering of virtual assets.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eOver $6.43 billion in virtual assets stolen from Binance, the largest cryptocurrency theft in history.\u003c/li\u003e\n\u003cli\u003eApproximately $2.85 billion in stolen assets has been frozen on-chain by various entities including Tether, Circle, Ripple, Arbitrum, and Optimism.\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImplement strict code review processes for any third-party infrastructure-as-code (IaC) modules, specifically Terraform providers.\u003c/li\u003e\n\u003cli\u003eAudit outbound network connections from build servers and developer workstations to prevent unexpected downloads of loaders from untrusted external sources.\u003c/li\u003e\n\u003cli\u003eImplement endpoint security monitoring to detect the execution of suspicious Bash scripts, Python information stealers, and the specific artifacts associated with FLATROOF and ROOFDECK implants.\u003c/li\u003e\n\u003cli\u003eReview recruitment and hiring practices to verify the identity of external recruiters and the legitimacy of job opportunities offered via social media or professional networks.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T08:57:56Z","date_published":"2026-11-01T08:57:56Z","id":"https://feed.craftedsignal.io/briefs/2026-11-tradertraitor-binance/","summary":"The North Korean-aligned actor TraderTraitor (UNC4899) stole $6.43 billion from Binance using recruitment-themed social engineering and trojanized Terraform providers to deploy multi-stage cross-platform malware.","title":"TraderTraitor: Large-scale cryptocurrency theft targeting Binance","url":"https://feed.craftedsignal.io/briefs/2026-11-tradertraitor-binance/"}],"language":"en","title":"CraftedSignal Threat Feed - Binance","version":"https://jsonfeed.org/version/1.1"}