SEAL: North Korean TraderTraitor Lurked for About 8 Weeks Before Binance Attack

PANews, November 6 - According to SEAL (Security Alliance), the disclosed details of the approximately $6.4 billion theft at Binance on October 29 align with the "shell company + multi-round interview" attack pattern commonly used by the North Korean hacker group TraderTraitor. This group is not the same as Contagious Interview, which also uses recruitment as a lure. SEAL stated that over the past year, TraderTraitor also used malicious Terraform programming tests to infiltrate LayerZero, malicious GitLab repositories to breach AFX, and is suspected of exploiting a 0-day vulnerability in a third-party security product to attack Bitget. It lurked within these institutions for approximately 3 to 6 weeks respectively, and about 8 weeks at Binance. SEAL also disclosed shell company domains such as citalab, bitfit, and oddium.