Federal Tergov Byurosi (FBI) Binance'dan 6 milliard dollardan ortiq virtual aktivlarning o'g'irlanishini Shimoliy Koreya xakerlari bilan bog'ladi va operatsiyani "TraderTraitor" deb nomladi.
31-oktabrda e'lon qilingan maslahatda FBI kriptovalyuta birjasi 2026-yil 29-oktabr atrofida nishonga olinganini xabar qildi. Bu e'lon rasmiy ayblov hisoblanadi, ammo texnik kirish nuqtasi yoki buzilish qanday sodir bo'lganini ochib bermaydi.
Binance buzildi
FBI, AQSh Maxfiy Xizmati va Ichki Daromad Xizmati Jinoiy Tergov bo'limi tergovchilari hujumchilarning o'g'irlangan aktivlarni asosan Ethereumga aylantirganini qayd etishdi.
Hokimiyatlar ushbu aktivlarning keyingi yuvilishi markazlashmagan moliya platformalari va tez almashuv xizmatlari orqali amalga oshirilishini kutishmoqda, bu esa daromadlarning keyingi harakatini osonlashtiradi. Ethereumga aylantirish kuzatilgan bo'lsa-da, keyingi yuvish faoliyatlari tafsilotlari taxminiy va tasdiqlanmaganligicha qolmoqda.
Maslahat Binance qanday buzilganini tushuntirishdan ko'ra, buzilishdan keyin o'g'irlangan mablag'larni kuzatishga urg'u beradi. U foydalanilgan zaiflikni, zararli dastur oilasini, buzilgan imzo mexanizmini yoki dastlabki kirish texnikasini aniqlamaydi. Shuning uchun bu hodisani fishing, o'g'irlangan shaxsiy kalitlar yoki ta'minot zanjiri buzilishiga bog'lash FBI bayonotida ochib berilgan ma'lumotlardan tashqariga chiqadi.
TraderTraitorning bulut va ta'minot zanjiriga qaratilgan oldingi xabarlarda ijtimoiy muhandislik, ma'lumot o'g'irlash va buzilgan ishlab chiqish muhitlari bilan bog'liq operatsiyalar tasvirlanadi. Bu tarix aktyorning imkoniyatlari haqida kontekst beradi.
Biroq, bu Binance o'g'irlanishiga xuddi shu texnikalar yordam berganini isbotlamaydi. Tarixiy savdo usullarini hodisaga xos dalillardan ajratish hujumni baholashda muhimligicha qoladi.
Taqdim etilgan maslahat matni THORNode operatorlari, RPC tugun operatorlari, tez almashuvlar, DeFi xizmatlari, blokcheyn tahlil kompaniyalari va boshqa virtual aktiv xizmat ko'rsatuvchilarni o'g'irlangan aktivlar bilan bog'liq tranzaksiyalarni bloklashga chaqiradi.
Uning so'ralgan doirasi aniqlangan hujumchi manzillari va shu manzillardan kelib chiqqan mablag'lar bilan bog'liq tranzaksiyalarni o'z ichiga oladi, bu esa javobni faqat dastlabki qabul qiluvchi hamyonlarni kuzatishdan kengaytiradi.
Taqdim etilgan material TraderTraitor bilan bog'liq manzillar ro'yxatini kiritgan bo'lsa-da, unda hech qanday hamyon manzili yo'q. Bu taqdim etilgan matnda tekshirish uchun amaliy manzil darajasidagi ko'rsatkichlar yo'qligini anglatadi. Shuningdek, unda tranzaksiya xeshlari, zararli dastur xeshlari, ta'sirlangan dasturiy ta'minot versiyalari yoki batafsil sud-tibbiy vaqt chizig'i yo'q. O'quvchilar ayblov e'lonini to'liq texnik hodisa hisoboti sifatida talqin qilmasliklari kerak.
Bybit buzilishidan keyingi Shimoliy Koreya kriptovalyuta hujumlari haqidagi tegishli xabarlar o'g'irlangan aktivlarni ketma-ket yuvish bosqichlari orqali kuzatishning davom etayotgan tergov qiyinchiligini ko'rsatadi. Biroq, bu topilmalar oldingi operatsiyalarga tegishli va Binance'ga xos dalil sifatida taqdim etilmasligi kerak.
Tegishli ma'lumotga ega shaxslar FBIning Internet Jinoyat Shikoyat Markazi orqali hisobot yuborishlari mumkin. IC3 kiberjinoyat shikoyatlarini to'playdi va tegishli huquqni muhofaza qiluvchi idoralarga tergov uchun yuborishi mumkin.
SOC'ga tezkor hodisalarni to'xtatish uchun ogohlantirish kontekstini bering. 16K SOC'dan tahdid razvedkasini integratsiya qiling.
The Federal Bureau of Investigation (FBI) has linked the theft of over $6 billion in virtual assets from Binance to North Korean hackers, labeling the operation as “TraderTraitor.”
In an advisory released on October 31, the FBI reported thatthe cryptocurrency exchange was targeted around October 29, 2026. This announcement marks an official attribution but does not disclose the technical entry point or how the compromise occurred.
Binance Hacked
Investigators from the FBI, the United States Secret Service, and the Internal Revenue Service Criminal Investigation have noted that the attackers have primarily converted the stolen assets into Ethereum.
Authorities anticipate that the subsequent laundering of these assets will involve decentralized finance platforms and instant swap services to facilitate further movement of the proceeds. While the conversion into Ethereum has been observed, details of downstream laundering activities remain speculative and unconfirmed.
The advisory emphasizes tracking stolen funds after the breach rather than explaining how Binance was compromised. It does not identify an exploited vulnerability, malware family, compromised signing mechanism, or initial access technique. Consequently, attributing this incident to phishing, stolen private keys, or a supply chain intrusion would go beyond what the FBI statement discloses.
Earlier reporting on TraderTraitor’s cloud and supply chain targeting describes operations involving social engineering, credential theft, and compromised development environments. That history provides context for the actor’s capabilities.
However, it does not establish that the same techniques enabled the Binance theft. Separating historical tradecraft from incident-specific evidence remains essential when assessing the attack.
The supplied advisory text calls on THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics companies, and other virtual asset service providers to block transactions associated with the stolen assets.
Its requested scope includes transactions involving identified attacker addresses and funds derived from those addresses, extending the response beyond monitoring the original receiving wallets.
Although the supplied material introduces a list of addresses associated with TraderTraitor, it includes no wallet addresses. This leaves the provided text without actionable address-level indicators for screening. It also contains no transaction hashes, malware hashes, affected software versions, or detailed forensic timeline. Readers should not interpret the attribution announcement as a complete technical incident report.
Related reporting on North Korean cryptocurrency attacks after the Bybit breach illustrates the continuing investigative challenge of following stolen assets through successive laundering stages. However, those findings concern earlier operations and should not be presented as Binance-specific evidence.
Individuals with relevant information can submit reports through the FBI’s Internet Crime Complaint Center. IC3 collects cybercrime complaints and may refer submissions to appropriate law enforcement agencies for investigation.
Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.