Executive Summary

Last week’s reporting was dominated by the theft of more than $6 billion in cryptocurrency from Binance. The FBI attributed the attack to North Korea and named the activity TraderTraitor. Binance said its initial investigation pointed to a compromised DevOps laptop and access to a service container, while blockchain investigators documented abuse of Ethereum account delegation and rapid, automated laundering across multiple chains.

Microsoft assessed that North Korean threat actors now use AI throughout reconnaissance, social engineering, fraudulent employment, and technical development. Separate research found Contagious Interview malware moving beyond targeted recruiter lures into ClickFix delivery on compromised WordPress sites. Other reports traced poisoned developer packages and repositories, sanctions evasion by IT-worker networks in Russia, and continued use of malicious shortcuts against South Korean targets.

Key Trends

1. TraderTraitor turned access around Binance’s wallets into a $6 billion theft

Binance estimated the impact of the October 29 incident at about $6.3 billion. Its initial investigation found that a compromised DevOps engineer’s laptop may have allowed an attacker to reach a service container and submit unauthorized withdrawal transactions. The exchange found no evidence of a wallet private-key leak, suspended withdrawals, revoked the affected address authorization, and said it would cover losses with company and SAFU funds.¹

Chainalysis calculated unauthorized transfers of about $6.4 billion across multiple blockchains and attributed the theft to TraderTraitor. Its strongest on-chain evidence was the commingling of Binance funds with proceeds from the DPRK-attributed Bitget theft. The firm also observed thousands of repetitive laundering transactions, including a recurring sequence in which new addresses first received exactly 1 TRX before receiving and forwarding more funds.²

The FBI then attributed the theft of more than $6 billion to North Korea and identified the activity as TraderTraitor. It said the actors were converting stolen assets mainly into ETH and expected further movement through decentralized finance and instant-swap services. The advisory published ETH, BTC, and SOL addresses for service providers to block.³

Elliptic traced $6.43 billion from hot wallets on 11 blockchains and verified about $2.85 billion in frozen or secured assets by November 1. On Ethereum, the attacker submitted 50 valid EIP-7702 authorizations covering consecutive nonces. One matched the hot wallet’s current transaction count and delegated the account to an attacker-controlled sweeper contract. That delegation enabled repeated withdrawals until Binance revoked it nearly four hours later.⁴

ThreatMon’s reconstruction reached the same central finding: the attacker used a trusted signing path rather than stealing a wallet key. The report found that the 50 authorizations were prepared for a range of possible nonces and that delegated code persisted after the first sweep. It recommends rejecting batches of consecutive EIP-7702 authorizations, monitoring treasury accounts for unexpected code, and rehearsing delegation revocation before an incident.⁵

Jamf placed the suspected DevOps compromise in the context of DPRK targeting of developers through coding tests, fake interview plugins, malicious repositories, and poisoned packages. The exact initial-access route at Binance remained under investigation, but the case exposed the risk created when a developer endpoint can reach production containers, CI/CD systems, or financial infrastructure.⁶

TRM attributed the attack to TraderTraitor with high confidence and traced about $6.36 billion from wallets on ten blockchains. It assessed that 50 pre-signed EIP-7702 authorizations and ordinary signed transfers from wallets on nine other chains pointed to compromise of cross-chain signing infrastructure. TRM also documented about $2.7 billion in freezes and more than $2.4 billion in ETH and BTC beyond issuer control.⁷

2. AI moved into routine North Korean operations

Microsoft assessed overall AI adoption among North Korean threat actors as high. It placed Jade Sleet, Coral Sleet, and Jasper Sleet in an operationalized stage, with Diamond Sleet, Onyx Sleet, Pearl Sleet, and Sapphire Sleet rapidly expanding use across multiple functions. Microsoft said the activity remained human-directed, with AI increasing the speed and scale of existing work rather than operating independently.⁸

Observed uses were practical. Jade Sleet prepared three job-themed front companies in one week. Onyx Sleet produced more than 100 target-specific PDF lures, with metadata indicating that dozens were created within minutes. Jasper Sleet used AI-assisted workflows to prepare resumes and employment personas, while Coral Sleet built capabilities for trojanizing private repositories. Microsoft also reported operational use of the ARTEX agentic penetration-testing framework by Onyx Sleet and Pearl Sleet.⁸

The defensive problem is faster variation rather than a new class of attack. Hiring teams may face more credible resumes and interview responses, while security teams see lures and infrastructure regenerated quickly enough to shorten the useful life of static indicators. Identity, endpoint, repository, and cloud evidence therefore need to be reviewed together.

3. Developer delivery moved across websites, packages, and repositories

Newton Paul connected targeted Contagious Interview routes with a broader ClickFix chain. Fake recruiters, interview camera fixes, and fake cryptocurrency-company sites all delivered portable Node.js loaders. The loaders stored code under .task and .vs_cache, recovered command servers from Polygon smart contracts, established Run-key persistence, and deployed an in-memory RAT with keylogging and Chrome credential-access components.⁹

The same malware also appeared behind ClickFix overlays injected into at least 36 compromised WordPress sites between October 17 and 28. The overlays matched the ErrTraffic service’s use of Polygon-hosted configuration, separate operating-system commands, and Win+X followed by I to open an administrative terminal. The researcher recorded 114 visits across 38 compromised sites where the overlay copied a command leading to the loader.⁹

ESET reported a wider move by Deceptive Development from fake interviews toward software supply-chain compromise. Operators harvested developer credentials and used them to inject malicious code into public and private repositories. ESET also observed Lazarus resume recruitment-themed targeting of the drone sector and assessed that access to production knowledge could support North Korea’s drone capabilities.¹⁰

OpenSourceMalware found the earliest known PolinRider component in nine npm package versions published from a compromised maintainer account in May 2025. Recovered packages used BNB Smart Chain and Ethereum transactions to deliver JADESNOW, an INVISIBLEFERRET bootstrapper, a Socket.IO RAT, and a cross-platform credential stealer. The 2025 chain lacked the automated force-push behavior seen in 2026, but shared keys, infrastructure, and server paths tied it to the later campaign.¹¹

The same researchers documented DPRK operators placing JavaScript in files named as WOFF, WOFF2, TTF, and OTF fonts. Some variants were force-pushed over already infected repositories, leaving older fake-font artifacts in history. The changing extensions make content and behavior more reliable detection points than file type alone.¹²

GitGuardian found the PolinRider launcher inside repositories also compromised by GhostAction. GhostAction copied the hidden VS Code folderOpen task and fake-font pattern into 17,667 repositories, while 188 GhostAction commits were later rewritten to include PolinRider loaders. GitGuardian found no clear relationship between the operators, but the overlap showed how stolen repository credentials can expose the same victims to separate campaigns.¹³

4. South Korean campaigns kept malicious shortcuts at the front of the chain

AhnLab’s September review found that spearphishing accounted for most APT activity observed against South Korean entities and that LNK files were the most common execution mechanism. One chain extracted a decoy document, a legitimate AutoIt binary, and a malicious AutoIt script from shortcut data, then created a scheduled task disguised as a OneDrive update. The implant received commands through PubNub channels derived from the computer and user names.¹⁴¹⁵

Other chains used curl.exe to retrieve HTA files from GitHub or Google Drive, loaded stealers and backdoors in memory, or downloaded scripts that deployed XenoRAT. A separate path used regsvr32.exe to load a malicious DLL from %ProgramData%. Across these cases, familiar Windows utilities and public services reduced the number of obviously malicious components on disk.¹⁴¹⁵

5. IT-worker enforcement reached managers, facilitators, and money flows

The U.S. Treasury sanctioned ten people and the DPRK-controlled First Financial and Technical Development Center for supporting North Korean IT-worker operations. The action covered managers and workers in Russia as well as financial facilitators. Treasury said Vitold Obertas had converted nearly $2 million in cryptocurrency for DPRK officials since January 2025, while Ilya Boykov had handled about $3.5 million for an IT-worker delegation since 2024.¹⁶

Chainalysis traced worker earnings through stablecoin and ETH transfers, sanctioned consolidation addresses, Russian intermediaries, and the Garantex exchange. Its analysis connected salary-like payments from a DPRK worker wallet to cash-out infrastructure and described generative AI, synthetic profile images, and deepfake video as tools used to support employment personas.¹⁷

TRM identified eight cryptocurrency addresses across three designated people and detailed the Russia-based delegations behind the action. Six workers linked to the First Financial and Technical Development Center generated more than $750,000 since 2025, while managers monitored workers and transferred revenue through cryptocurrency.¹⁸

A separate Justice Department case exposed the domestic hardware side of the scheme. A defense-contractor employee with an active Top Secret clearance pleaded guilty after allowing foreign operators to use his identity and another stolen identity for remote applications. He received employer laptops at his Virginia home and enabled access from abroad; the applications produced nine job offers, including offers from government contractors.¹⁹

Security Alliance recorded three DPRK-related incidents with $3.22 million in losses. A wallet extension replaced during an April infection led to a $3.19 million theft six months later, and two Contagious Interview victims lost another $34,800. The delay between compromise and theft makes old developer and wallet access part of current incident response, even when the original lure is months past.²⁰

What to Watch

Cryptocurrency custodians should treat signer access as a transaction-integrity problem alongside key custody. Monitor authorization volume and nonce patterns, check treasury accounts for unexpected delegated code, map every developer and service path that can submit transactions, and make revocation steps executable under incident pressure. Blockchain teams should expect stolen assets to move through automated cross-chain routes long after the initial freeze window.

Organizations targeted through employment or developer workflows should correlate recruiter contact, repository execution, browser-delivered shell commands, package installation, and later access to production systems. AI can make each lure look different, but the endpoint and identity transitions still leave evidence. South Korean organizations should also review shortcut execution, scheduled tasks, AutoIt and PowerShell chains, and unexpected PubNub or public code-hosting traffic.

Reports Reviewed