Binance's first lead in its record crypto theft is a DevOps laptop; here's how to check your clients' engineers for TraderTraitor's lure.
Binance's first lead in the biggest crypto theft on record isn't a broken smart contract but one engineer's work laptop. On 29 October 2026, attackers moved about $6.36 billion out of Binance wallets, most of it within roughly 20 minutes, TRM Labs found. Check every client's developer laptops and Terraform files (code that builds cloud servers) today for the job-test lure TraderTraitor uses.
registry.terraform.io, SentinelOne warns.The Binance hack is the 29 October 2026 theft of about $6.36 billion in crypto from the Binance exchange, which the FBI, working with the Secret Service and IRS investigators, attributes to North Korea's TraderTraitor unit (also tracked as Jade Sleet and UNC4899), according to The Hacker News. The group's known way in is still in use: SentinelOne found fake job tests whose Terraform lock files pull a malicious plugin from look-alike HashiCorp domains, and Zscaler found a trojanized Terraform provider that installs backdoors on macOS, Linux and Windows. Binance has not said how its engineer's laptop was compromised.
It is the largest crypto heist on record, more than four times the $1.46 billion taken from Bybit in February 2025, by Elliptic's count. Totals differ by source: TRM counts $6.36 billion over ten blockchains, Elliptic $6.43 billion, Binance about $6.3 billion, and The Hacker News 11 blockchains. TRM says about $2.7 billion was frozen, while more than 420,000 ETH (Ether) and 18,270 BTC (Bitcoin), about $2.4 billion, sit beyond any issuer's reach; The Hacker News reports $2.85 billion frozen.
Run these on every engineer laptop and build server you manage, as a normal user with sudo (PowerShell as administrator on Windows). Paths and domains come from SentinelOne and Zscaler. Log searches start on 16 February 2026, 30 days before SentinelOne's earliest sighting on 18 March 2026; on-device logs rarely reach that far, so a clean short log can't rule out earlier contact.
Preserve evidence. Copy shell histories, Terraform settings and login items with their full paths, then hash the copy. Pass: the .sha256 file lists every copied file.
# macOS or Linux; errors for paths absent on this OS are expected
D=/var/tmp/ir-$(hostname)-$(date +%F); sudo mkdir -p "$D"
sudo rsync -aR /home/*/.*history /Users/*/.*history /Users/*/.zlogout /Users/*/Library/LaunchAgents /home/*/.terraform.d /Users/*/.terraform.d "$D"/
# macOS without sha256sum: use 'shasum -a 256' in its place
sudo find "$D" -type f -exec sha256sum {} + | sudo tee "$D.sha256"
# Windows, PowerShell as administrator
$D="C:\IR\$env:COMPUTERNAME"; New-Item -ItemType Directory -Force $D | Out-Null
Get-ChildItem C:\Users -Directory | ForEach-Object { $s="$($_.FullName)\AppData\Roaming\terraform.d"; if (Test-Path $s) { Copy-Item $s "$D\$($_.Name)-terraform.d" -Recurse } }
Get-ChildItem $D -Recurse -File | Get-FileHash -Algorithm SHA256 | Export-Csv "$D.sha256.csv"
Find lock files naming a rogue registry. Prints each provider in a .terraform.lock.hcl (Terraform's plugin list) that isn't hosted on registry.terraform.io, the warning sign SentinelOne describes. Pass: no output.
# CI runners keeping workspaces elsewhere: add that root to the list
for R in /home /Users /root /srv /opt /builds /var/lib; do [ -d "$R" ] && sudo find "$R" -name .terraform.lock.hcl -print0 2>/dev/null; done | xargs -0 sudo grep -HoE 'provider "[^"]+"' | grep -v '"registry.terraform.io/'
Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { Get-ChildItem "$($_.DeviceID)\" -Recurse -Force -File -Filter .terraform.lock.hcl -EA SilentlyContinue } | Select-String 'provider "' | Where-Object { $_.Line -notmatch '"registry\.terraform\.io/' }
Look for the published backdoor files. Checks the paths both reports give for FLATROOF and ROOFDECK (remote-control backdoors) and the fake awsbeta provider; a hit means treat the machine as compromised. Pass: no output, or each hit hashed and reviewed.
for U in /Users/* /home/* /root; do sudo ls -la "$U/Library/com.apple.iTunesCloud/SystemUpdate" "$U/Library/com.apple.internal.ck/iSync" "$U/Library/com.apple.appleaccountd/loginwindow" "$U/.config/git/update" "$U/DevOps-Automation/cloudshield" 2>/dev/null; done
for R in /home /Users /root /srv /opt /builds /var/lib; do [ -d "$R" ] && sudo find "$R" -name 'terraform-provider-awsbeta*' 2>/dev/null; done
# hash a hit and compare with SentinelOne's SHA1 and Zscaler's MD5 lists
sudo shasum -a 1 "<hit>"; sudo md5sum "<hit>" 2>/dev/null || sudo md5 "<hit>"
Get-ChildItem C:\Users\*\AppData\Local\Microsoft\Edge\service.exe -Force -EA SilentlyContinue | Get-FileHash -Algorithm MD5
Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { Get-ChildItem "$($_.DeviceID)\" -Recurse -Force -File -Filter 'terraform-provider-awsbeta*' -EA SilentlyContinue }
Search DNS and proxy logs for the published domains and IPs. A hit is contact with known attacker infrastructure: treat it as a likely compromise and escalate. Pass: no output from 16 February 2026 onward.
# run over the client's exported DNS-filter, proxy or SIEM logs
zgrep -EiH 'hashicorp-aws\.(com|io)|hashicorp-terraform\.io|technicais\.sytes\.net|storage\.hubpage\.cloud|grenight\.com|delay\.servehttp\.com|arusupport-region1-webhook\.online|supportaru\.serveftp\.com|176\.97\.114\.232|45\.11\.59\.140|85\.137\.56\.(245|10)' /path/to/exported-logs/*
List login-time persistence. Shows the LaunchAgents, logout scripts, Linux services and Windows Run values the reports name as the backdoors' restart method. Pass: every line prints nothing.
sudo grep -l -- '--type=renderer' /Users/*/Library/LaunchAgents/*.plist 2>/dev/null
sudo grep -l 'imagent' /Users/*/.zlogout 2>/dev/null
systemctl list-unit-files --all 2>/dev/null | grep -i imagent
sudo find /etc/systemd /home/*/.config/systemd /root/.config/systemd -name '*imagent*' 2>/dev/null
# HKEY_USERS holds only loaded user hives; run while users are signed in
Get-ChildItem Registry::HKEY_USERS | ForEach-Object { Get-ItemProperty "Registry::$($_.Name)\Software\Microsoft\Windows\CurrentVersion\Run" -EA SilentlyContinue } | Where-Object { $_.'powershell-config-service' }
Preserve evidence. Move the folder and hash file from check 1 off the machine before changing anything. Pass: the listing on the evidence host shows both.
# same shell as check 1, so "$D" is still set
sudo rsync -a "$D" "$D.sha256" <evidence-host>:/evidence/
ssh <evidence-host> ls -la /evidence/
Cut the machine off. Unplug it or use the client's EDR network-isolation action, leaving it powered on. Pass: ping <laptop-ip> from the client network gets no reply.
Rebuild it. Reimage from known-good media rather than deleting files, because ROOFDECK offers a remote shell and file theft, per SentinelOne. Pass: checks 3 and 5 print nothing on the rebuilt machine.
Rotate what it held. From a clean machine, replace each AWS key it stored using AWS's CLI flow, and delete its keys under GitHub's Settings → SSH and GPG keys, per GitHub. Pass: the old key's call fails.
aws iam create-access-key --user-name <user>
aws iam update-access-key --user-name <user> --access-key-id <old-id> --status Inactive
AWS_ACCESS_KEY_ID=<old-id> AWS_SECRET_ACCESS_KEY=<old-secret> aws sts get-caller-identity # must fail
aws iam delete-access-key --user-name <user> --access-key-id <old-id>
aws iam list-access-keys --user-name <user> # only the new key
# IAM users created since the hunt window opened: review each one
aws iam list-users --query "Users[?CreateDate>='2026-02-16'].[UserName,CreateDate]" --output table
Fail builds on rogue registries. Add this pipeline step, because HashiCorp's lock file rejects mismatched checksums but a hostile one names its own registry; private mirrors fail until allowed. Pass: a test lock file naming registry.example.com fails.
! find . -name .terraform.lock.hcl -print0 | xargs -0 grep -hoE 'provider "[^"]+"' | grep -v '"registry.terraform.io/'
Rerun the checks. Pass: checks 2 to 5 print nothing on each engineer machine.
By Binance's initial account, the laptop reached a service container (a small packaged server program) that could submit withdrawals, it told BleepingComputer. Co-CEO Richard Teng added that "the attacker did not simply use one engineer's permissions," and Binance says it "uncovered additional points of breach."
The risk reaches beyond exchanges. SentinelOne found the same backdoors on an India-based IT services provider with no crypto ties, reached through a DevOps engineer's MacBook. Microsoft reports Jade Sleet posed as recruiters for a fake AI blockchain firm from 8 to 12 June 2026, targeting people at cybersecurity, AI, blockchain and recruitment companies.
Elliptic says "this single incident almost doubles the total cryptoassets stolen by the regime." For an IT provider, the lesson is that an engineer laptop holding cloud keys and Git access is a production server in all but name.
KinoSec's autonomous Active Directory and external network pentest checks how far one foothold inside a client's network can chain toward the servers that move money or ship code, like the container Binance says submitted the withdrawals. It does not scan laptops for FLATROOF or ROOFDECK; checks 2 to 5 do that. What it adds is the map: which internal services and web apps answer, which weaknesses link them, and what to fix first, in a report you hand the client. It is the same reconnaissance an intruder runs, done with your client's permission, scope limits and a report they can act on.
TraderTraitor is a North Korean state hacking unit that TRM Labs also tracks as Lazarus Group and APT38, according to BleepingComputer. The Hacker News lists its other names as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces and UNC4899. TRM Labs notes the FBI named the same group for the 2025 Bybit theft.
First, list the registries in a repo's lock files with grep -rhoE 'provider "[^"]+"' --include='*.lock.hcl' .; anything outside registry.terraform.io is suspect, per SentinelOne. Second, on a Mac, run ls /Users/*/Library/com.apple.iTunesCloud/SystemUpdate, the FLATROOF path SentinelOne lists. Third, run grep -l -- --type=renderer /Users/*/Library/LaunchAgents/* to find ROOFDECK's login item. A hit on either file check means treat the laptop as compromised.
Allow them, but commit a lock file your own team generated with terraform providers lock, never one that arrives inside a test repo, per HashiCorp. Terraform then refuses any package whose checksum doesn't match. SentinelOne warns that malicious packages can also sit on the official registry, so review each provider's publisher before it enters the lock file.
Binance says losses will be covered from SAFU, its emergency user-protection fund, and company funds, and that user funds are safe, per BleepingComputer. Withdrawals were paused after the theft, and Binance began resuming them in a "phase one" on 1 November 2026, The Hacker News reports.