SEAL: North Korea's TraderTraitor Lurked About 8 Weeks Before Attacking Binance

November 6 — According to SEAL (Security Alliance), the disclosed details of the roughly $6.4 billion theft from Binance on October 29 match the "shell company + multiple rounds of interviews" attack pattern habitually used by the North Korean hacker group TraderTraitor. This group is not the same as Contagious Interview, which also uses recruitment as bait. SEAL said that over the past year, TraderTraitor also used a malicious Terraform coding test to breach LayerZero, used a self-built malicious GitLab repository to breach AFX, and is suspected of using a 0day vulnerability in a third-party security product to breach Bitget. It lurked inside those organizations for about 3 to 6 weeks each, and about 8 weeks at Binance. SEAL also disclosed the domains of shell companies such as citalab, bitfit and oddium.