crypto theft5 articles
North Korea Stole $6.3 Billion From Binance. Now a Robot Is Laundering It.
The FBI has attributed the record-breaking $6.3 billion Binance cryptocurrency heist — carried out on October 29 by North Korean state-sponsored hacking group TraderTraitor — and released a list of over 600 blockchain addresses linked to the stolen funds, urging crypto industry participants to block associated transactions. Binance confirmed the attack was more sophisticated than initially thought, involving multiple breach points and a self-destruct mechanism to erase evidence, though the exchange pledged to cover all user losses. Blockchain analytics firms have identified the laundering operation as likely automated, with funds being moved continuously around the clock across hundreds of wallets and multiple blockchains.
North Korea's Lazarus Group Pocketed $6.3 Billion from Binance. Good Luck Getting It Back.
The FBI has attributed the record $6.3 billion theft from cryptocurrency exchange Binance to North Korea's Lazarus Group, specifically its TraderTraitor hacking operation, which has been linked to multiple previous crypto exchange heists. The attack originated from a compromised employee laptop and saw most funds stolen within around 20 minutes, with hackers now attempting to launder the money through Ethereum and decentralised finance platforms. Binance has since resumed withdrawals and says it has replenished approximately 95% of the stolen assets from its own reserves, though the exchange saw around $3.64 billion in net outflows following the incident.
North Korea's TraderTraitor Blamed for Record $6.43 Billion Binance Hack
The FBI, alongside the USSS and IRS-CI, has attributed the record-breaking theft of $6.43 billion in cryptocurrency from Binance to TraderTraitor, a North Korea-linked hacking group. The stolen funds, spread across 11 blockchains, are being laundered through Ethereum, DeFi services, and instant swap platforms, though $2.85 billion has been frozen by various blockchain firms. TraderTraitor carries out its attacks through sophisticated social engineering tactics, including AI-enhanced fake recruitment campaigns and trojanized software, to trick victims into installing malware and gain remote access to their systems.
North Korea's Fake Recruiters Have Infected 30,000 Devices and Counting
North Korea-linked cybercriminals, tracked as WaterPlum, have infected over 30,000 devices and stolen more than $10 million by posing as job recruiters and tricking applicants into downloading malware disguised as coding tests or recruitment materials. Once installed, the malware gives attackers persistent access to credentials, cryptocurrency wallets, and sensitive data, with proceeds funnelled to the North Korean regime. This scheme complements North Korea's broader strategy of placing fraudulent IT workers inside Western companies, an operation estimated to generate over $500 million annually for Pyongyang.
ClickFix Malware Can Slowly Bleed Your Crypto Wallet Dry
ClickFix-style attacks are being used to deliver a Go-based macOS malware that steals browser passwords, Apple Keychain data, and cryptocurrency wallet contents, with the ability to gradually drain funds across multiple cryptocurrencies including Bitcoin, Ethereum, and Monero. The attack tricks victims into pasting a command into Terminal, which profiles the system, downloads a compatible payload, and uses a fake error prompt to harvest system credentials. The malicious infrastructure is linked to Aeza Group, a Russian bulletproof hosting provider sanctioned by the US, UK, and Australia.