The FBI ties the $6.3B Binance hack to TraderTraitor, which targets engineers' laptops; here's how to check your clients' developer machines.
The largest crypto theft on record didn't start at a vault door. Binance says it may have started with one DevOps engineer's laptop, and the North Korean group the FBI now blames has a well-documented way onto engineers' laptops: a recruiter with a dream job and a "quick coding test."
Attackers moved roughly $6.3 billion out of Binance hot wallets on October 29, 2026, most of it in minutes. TRM Labs counted "approximately USD 6.36 billion" across ten blockchains, "most of it in about 20 minutes starting at 20:05 UTC," and said preparation began at least 36 hours earlier.
Binance's first explanation, per The Hacker News, was that the incident "may have started with a compromised DevOps engineer's laptop," which gave the attacker a service container that submitted the withdrawals. Binance later said it had "uncovered additional points of breach," and co-CEO Richard Teng wrote on X, as quoted by The Next Web, that "the attacker did not simply use one engineer's permissions, and this was not a single 'one-click' action." Binance also said it "found no evidence of any wallet private key leak," AP reported. The attackers didn't steal the keys; they got Binance's own systems to sign.
TRM Labs and Chainalysis had already linked it to TraderTraitor, AP reported. On October 31, the FBI, with the Secret Service and IRS-CI, named TraderTraitor and listed 608 Ethereum, 19 Bitcoin and 1 Solana address, according to SecurityWeek. Binance says it worked with partners to freeze "roughly $3 billion," per AP; TRM counts about $2.7 billion.
TraderTraitor's documented opening move is a fake job offer sent to the people who hold the keys. Binance hasn't said how its engineer's laptop was compromised, so treat what follows as the group's known pattern, not the Binance root cause.
CISA's 2022 advisory says intrusions begin with spearphishing aimed at staff "often working in system administration or software development/IT operations (DevOps)," and that the messages "often mimic a recruitment effort and offer high-paying jobs." The lure is usually a trojanized trading or price-prediction app for Windows or macOS.
The 2024 DMM Bitcoin theft shows the full chain. The FBI said, per BleepingComputer, that a fake recruiter sent a Ginco employee a "pre-employment test" that meant running malicious Python code. The attackers then used stolen session cookies to impersonate that employee and manipulate a transaction worth $308 million.
Think of it as a burglar who doesn't pick your lock. He mails your night guard a job application, and the guard carries it inside.
The same path exists at almost every client with a developer, a cloud account and a domain. The laptop is the guard; the prize is whatever that laptop can already reach. For a typical client that's an AWS access key in a dotfile, a Kubernetes config with cluster-admin, or a daily-use account sitting in Domain Admins. None of that needs an exotic exploit.
Run steps 1 to 4 as one script across your clients' developer Macs and Linux machines through your RMM tool. Run steps 5 and 6 from your admin machine.
sha256sum for shasum -a 256.D="/var/tmp/evidence-$(hostname)-$(date +%F)"; sudo mkdir -p "$D"
sudo rsync -aR /Users/*/.zsh_history /Users/*/.bash_history /Users/*/.ssh /Users/*/.aws /Users/*/.kube /Users/*/Library/LaunchAgents /home/*/.bash_history /home/*/.ssh /home/*/.aws /home/*/.kube /Library/LaunchAgents /Library/LaunchDaemons "$D"/ 2>/dev/null
sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
sudo find /Users /home -maxdepth 4 \( -path '*/.aws/credentials' -o -path '*/.kube/config' -o -path '*/.docker/config.json' -o -path '*/.ssh/id_*' \) -print 2>/dev/null
sudo ls -la /Library/LaunchAgents /Library/LaunchDaemons /Users/*/Library/LaunchAgents 2>/dev/null
sudo ls -la /etc/cron* /var/spool/cron/* /usr/lib/cron/tabs 2>/dev/null
sudo lsof -nP -iTCP -sTCP:ESTABLISHED | grep -Ei '^(node|python)'
list-access-keys across all IAM users in all AWS CLI profiles on your admin machine. Disable any key belonging to a human with production rights using update-access-key, as below. Pass: rerun the loop and the key no longer shows, and aws sts get-caller-identity with the old key fails.for p in $(aws configure list-profiles); do
for u in $(aws iam list-users --profile "$p" --query 'Users[].UserName' --output text); do
aws iam list-access-keys --profile "$p" --user-name "$u" --query 'AccessKeyMetadata[?Status==`Active`].[UserName,AccessKeyId,CreateDate]' --output text | sed "s|^|$p |"
done
done
aws iam update-access-key --profile <profile> --user-name <user> --access-key-id <key-id> --status Inactive
Get-ADGroupMember. Remove any developer's everyday account, then rerun and confirm only the expected admin accounts remain.Get-ADGroupMember -Identity 'Domain Admins' -Recursive | Select-Object Name,SamAccountName
Then tell client engineers the CISA lesson in one line: a take-home test from a recruiter runs in a throwaway virtual machine, never on the work laptop.
Attackers who breach a laptop to drain a treasury are running an intrusion, not a pentest. A pentest is the same reconnaissance done with permission, inside a scope, ending in a report the owner can act on. KinoSec can't stop a recruiter's email from landing, and we won't pretend it can.
What KinoSec does is the second half of the Binance chain. It runs autonomous pentests of your clients' web apps, external networks and Active Directory, chaining weaknesses the way an attacker would: from one foothold to stored credentials, to over-privileged accounts, to the systems that matter. You can run it across every client on demand and hand each one a report showing which paths lead from an ordinary account to the crown jewels, with remediation.
On October 31, 2026, the FBI attributed the roughly $6.3 billion Binance theft to North Korea's TraderTraitor, also tracked as Lazarus Group, Jade Sleet and APT38. TRM Labs and Chainalysis had already linked it to the same group. The FBI listed 608 Ethereum, 19 Bitcoin and 1 Solana address, according to SecurityWeek.
Binance's first explanation, per The Hacker News, was that the incident "may have started with a compromised DevOps engineer's laptop," which gave the attacker a service container that submitted the withdrawals. Binance later said it had "uncovered additional points of breach," and AP reported that Binance "found no evidence of any wallet private key leak." Binance hasn't said how the laptop was compromised.
First, run sudo find /Users /home -maxdepth 4 with the body's step 2 filters to list AWS, Kubernetes, Docker and SSH credential files. Second, run the body's step 5 loop, which calls aws iam list-access-keys across all IAM users in all AWS CLI profiles. Third, list Domain Admins with Get-ADGroupMember -Identity 'Domain Admins' -Recursive.
Yes, that is its documented pattern. CISA's 2022 advisory says the messages "often mimic a recruitment effort and offer high-paying jobs" and target DevOps and IT staff. In the 2024 DMM Bitcoin theft, the FBI said, per BleepingComputer, that a fake recruiter's "pre-employment test" ran malicious Python code on an employee's machine.