Skip to content

27 results for “TRM”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types27Articles24Write-ups2Repos1
“TRM”
decrypt.coarticle🛡️ Security

Binance Hack: Everything You Need to Know About the Biggest Crypto Heist in History

Decrypt's explainer on the roughly $6.4 billion theft from Binance hot wallets across about 10 blockchains. Binance traced it to a compromised DevOps engineer laptop plus further breach points, and on Ethereum the attacker used 50 pre-signed EIP-7702 authorizations to turn a hot wallet into a sweeper. Chainalysis and TRM Labs attribute it to TraderTraitor; Tether and Circle froze about $2.3 billion.

EthereumBitcoinTether+3
TraderTraitorBinanceChainalysis+10

Blockchain, Threat Intel· Published and added 31 Oct 2026

stepsecurity.ioarticle🛡️ Security

Binance’s $6.3 Billion Hack Puts Developer Machine Security in Focus

StepSecurity's analysis of Binance's 29 October 2026 incident, which Binance puts at about $6.3 billion in affected assets. It covers Binance's disclosure of a possible DevOps laptop compromise, and TRM Labs and Elliptic findings on 50 EIP-7702 authorizations and a persistent delegation. It links this to the Nx, OVHcloud CLI and Claude Code extension compromises, gives an investigation checklist, then describes StepSecurity products.

EthereumnpmVS Code+3
BinanceTRM LabsElliptic+5

Blockchain, Supply Chain· Published and added 30 Oct 2026

theblock.coarticle🛡️ Security

President Trump says they’re looking into Binance hack as calls grow for crypto rules

The Block reports that Binance lost about $6.3 billion in a hack on 29 October 2026. Co-CEO Richard Teng said a compromised DevOps engineer's laptop gave access to a service container used to submit unauthorized withdrawals, and TRM Labs attributed the theft to North Korea's TraderTraitor. The rest covers reactions: President Trump said on 30 October he was looking into it, CFTC Chair Michael Selig and The Digital Chamber urged federal exchange rules, and senators disputed whether the Clarity Act would have allowed freezes.

BinanceTraderTraitorTRM Labs+5

Threat Intel, Blockchain· Published and added 30 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: Binance Hacked; Hyperliquid on Wall Street; Prediction Markets’ Brazil ‘Miss’

Galaxy Research's weekly brief of 30 October 2026 opens with the Binance hack: about $6.3b drained across 10 blockchains, attributed by TRM Labs and Chainalysis to TraderTraitor (Lazarus-linked). The attacker used EIP-7702 with 50 pre-signed authorizations on Ethereum, and Binance's preliminary finding is a compromised DevOps laptop reaching a service container. Tether and Circle froze about $2.6b. The other sections cover Hyperliquid and prediction markets.

EthereumBitcoinUSDC+2
TraderTraitorLazarus GroupEIP-7702+7

Blockchain, Threat Intel· Added 30 Oct 2026

galaxy.comarticle🛡️ Security

Here We Go Again: Binance Loses $6.3b in Largest Robbery in History

Galaxy Research newsletter on the roughly $6.3b drained from Binance across 10 blockchains, which TRM Labs and Chainalysis attribute to TraderTraitor. On Ethereum the attacker used EIP-7702 to turn a hot wallet into a sweeper contract backed by 50 pre-signed authorizations. Binance's preliminary finding is a compromised DevOps laptop, with no wallet key leak. Tether, Circle, Ripple and World Liberty froze about $2.7b; Galaxy also assesses Binance's ability to cover losses.

EthereumBitcoinTether+3
TraderTraitorLazarus GroupBinance+7

Blockchain, Threat Intel· Added 30 Oct 2026

bankless.comarticle🛡️ Security

Binance Just Suffered the Biggest Hack in Crypto History. What Now?

Bankless report on the Binance hack of $6.3 billion, which Binance's preliminary investigation traced to a compromised DevOps engineer's laptop with access to withdrawal-authorizing systems. TRM Labs found valid EIP-7702 authorizations on Ethereum, and nine other chains were drained through normally signed transactions. TRM and Chainalysis link it to North Korea's TraderTraitor. Tether and Circle froze about $3 billion, and Binance says SAFU and corporate cash will cover the losses.

EthereumBitcoinSolana+1
BinanceTraderTraitorDPRK+9

Blockchain, Threat Intel· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

Secret Service, FBI Join Binance Hack Probe as Circle Freezes $823 Million

Decrypt reports that Binance is working with the FBI and U.S. Secret Service after a theft of about $6.4 billion, which TRM Labs and Chainalysis attribute to North Korea's TraderTraitor group, also linked to the February 2025 Bybit hack. Circle froze about $823 million in USDC and Tether froze USDT, though the page gives differing Tether totals. Binance first suspected a compromised DevOps engineer laptop, found more breach points, and saw no evidence of leaked wallet private keys.

USDCTether
TraderTraitorBinanceBybit+10

Blockchain, Threat Intel· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

Binance Sets Aside $6.34B to Cover Hack Losses, CEO Says 'Your Assets Are Safe'

Decrypt reports on the October 2026 Binance hot-wallet hack, about $6.3 billion, which Binance CEO Richard Teng says the company will cover with over $6.34 billion of its own funds. Teng says the attacker used an EIP-7702 delegation that skipped Binance's approval controls, a self-destruct mechanism to wipe tooling, and more than one breach point beyond a compromised laptop. TRM Labs and Chainalysis attribute the theft to TraderTraitor, and the attacker is still moving funds on Tron.

EthereumTronAave+1
TraderTraitorEIP-7702Binance+5

Blockchain, Threat Intel· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

What is EIP-7702? The Ethereum Upgrade Behind the $6.4B Binance Hack

EIP-7702 ("Set Code for EOAs") is the Ethereum change, live since the Pectra upgrade on 7 May 2025, that lets ordinary wallets delegate to smart contract code. The guide covers set-code transactions, delegation indicators, batching, sponsorship and sweeper-contract scams. It then describes the 29 October 2026 Binance theft of about $6.4B, which TRM Labs and Chainalysis attributed to TraderTraitor, where 50 pre-signed authorizations turned a hot wallet into a sweeper.

EthereumTornado Cash
EIP-7702EIP-8141TraderTraitor+10

Blockchain, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

Bulletproof Host Virtualine Loses Its Domain to FBI Seizure

Virtualine is a Russian-speaking bulletproof hosting provider whose domain virtualine.net the FBI seized. Court documents say it hosted phishing, spam, carding and illicit content, and ignored abuse reports. TRM Labs says it received more illicit-attributed cryptocurrency than any other labeled bulletproof host, mostly from a Russian drug marketplace (44%) and a sextortion scheme (17%), and later from StealC operators in 2026.

Bitcoin
VirtualineStealCFBI+3

Threat Intel· Published and added 30 Oct 2026

theblock.coarticle🛡️ Security

Binance says it has $6.34 billion ready to cover hack losses

The Block reports that Binance says it has set aside $6.34 billion of its own funds to cover a hack it puts at about $6.3 billion. Co-CEO Richard Teng says the entry point was a compromised DevOps laptop and no private key leak was found. About $3 billion was frozen by Tether, Circle, Ripple and others, withdrawals are suspended, and TRM Labs sees parallels with North Korean attacks. Technical detail is thin.

BinanceTRM LabsTether+4

Blockchain, Threat Intel· Published and added 30 Oct 2026

aikido.devarticle🛡️ Security

Binance hack: how a compromised developer laptop can lead to a $6.3 billion breach

Aikido Security's analysis of the roughly $6.3 billion Binance incident, which Binance says may have started with a compromised DevOps engineer's laptop. It sets out what is known (no private key leak, TraderTraitor attribution by TRM Labs and Chainalysis, additional breach points) and a plausible chain from laptop credentials to a withdrawal service. It compares the 2025 Bybit theft and lists mitigations.

npmVS CodeAWS+1
BinanceTraderTraitorLazarus Group+9

Blockchain, Threat Intel, Supply Chain· Published and added 30 Oct 2026

decrypt.coarticle🛡️ Security

TRM and Chainalysis Tie $6.4B Binance Hack to North Korea's TraderTraitor

TRM Labs and Chainalysis attribute the October 2026 Binance theft, about $6.4 billion across 10 blockchains, to North Korea's TraderTraitor. On Ethereum the attacker used EIP-7702 delegation with 50 pre-signed authorizations to turn a hot wallet into a sweeper, pointing to compromised signing infrastructure. The attacker funded wallets via Tornado Cash, laundered through automation and Aave borrowing, and about $3 billion was frozen.

EthereumEIP-7702Tornado Cash+2
TraderTraitorDPRKBinance+9

Blockchain, Threat Intel· Published and added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

TRM says Binance crypto hack stole $6.36B across 10 chains, mostly in 20 minutes

Report on the 29 October 2026 Binance theft, which TRM Labs valued at USD 6.36 billion across ten chains, mostly within 20 minutes. TRM attributes it with high confidence to North Korea's TraderTraitor. The attacker used pre-signed EIP-7702 delegations to turn a Binance Ethereum hot wallet into a sweeper. About USD 3 billion was frozen; TRM advises monitoring for unexpected delegations and separating signing infrastructure.

EthereumBitcoinTron+3
TraderTraitorEIP-7702Binance+11

Blockchain, Threat Intel· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Binance links $6.3 billion crypto theft to compromised DevOps laptop

Binance linked the theft of about $6.3 billion in crypto to a compromised DevOps engineer's laptop, which let attackers reach a service container and submit unauthorized withdrawals. TRM Labs and Chainalysis attribute the 29 October 2026 attack to North Korea's TraderTraitor. About $2.7 billion was frozen, and the attackers hold about $2.4 billion. Binance has found no evidence of a leaked wallet private key.

BinanceTetherCircle+3
TraderTraitorLazarus GroupAPT38+5

Blockchain, Threat Intel· Published and added 30 Oct 2026

securityweek.comarticle🛡️ Security

$6 Billion Binance Hack Bears Hallmarks of North Korea’s TraderTraitor

The Binance hack of 29 October 2026 drained about $6.36 billion across ten blockchains in roughly 20 minutes, according to TRM Labs. TRM attributes it with high confidence to North Korea's TraderTraitor, citing a mixer-funded operator wallet, pre-signed transactions and overlap with the Bybit and KelpDAO hacks. Binance's early findings point to a compromised DevOps engineer laptop. Stablecoin issuers froze about $2.7 billion.

EthereumTornado CashTether+2
TraderTraitorLazarus GroupDPRK+11

Blockchain, Threat Intel· Published and added 30 Oct 2026

en.cryptonomist.charticle🛡️ Security

Binance probes a suspected cryptocurrency breach: $6.3B affected, about $3B frozen

Binance disclosed a suspected security incident on 29 October 2026, estimating $6.3 billion affected and about $3 billion frozen. Binance's early finding is that a compromised DevOps engineer's laptop let an attacker reach a service container and submit unauthorized withdrawals, with no evidence of wallet private-key leakage. TRM Labs suspects TraderTraitor, the group tied to the February 2025 Bybit theft. Tether, Circle and Ripple froze funds.

TetherUSDC
BinanceTraderTraitorLazarus Group+7

Blockchain, Threat Intel· Published and added 30 Oct 2026

bleepingcomputer.comarticle🛡️ Security

Police seize Virtualine bulletproof service tied to ransowmare, cybercrime

Virtualine, a bulletproof hosting service also operating as Secury, Massgod, Spamhouse, Lanedo and Omegatech, had its main domain seized by the FBI with German, Dutch and UK partners. Chainalysis and TRM Labs traced its Bitcoin payments to ransomware (5% of flows), a Russian drug market (about 44%), sextortion and the StealC infostealer. Dutch police seized dozens of servers in Limburg and recovered data on over 3,000 customers.

Bitcoin
VirtualineSecuryMassgod+14

Threat Intel· Added 30 Oct 2026, published 28 Oct 2026

github.comrepo🛡️ Security

Spectrmachina/Ztrust

ZTrust is a Python supply-chain scanner that checks manifests, lockfiles, source and GitHub workflows for vulnerable or malicious dependencies (via OSV.dev), typosquats, leaked secrets, unsafe lockfiles and risky CI patterns such as pwn requests and script injection. It outputs console, JSON and SARIF 2.1.0 and ships as a GitHub Action. It also includes a FastAPI bounty service using commit-reveal and shielded Zcash payouts for researchers.

PythonGitHub ActionsOSV+3
xz-utilstj-actions/changed-filesevent-stream+3

Supply Chain, DevSecOps· Added 27 Oct 2026, published 22 Oct 2026

en.cryptonomist.charticle🛡️ Security

Stolen Ethereum laundering resumes as 25,700 ETH flow into Tornado Cash mixer

Report on wallets linked to the April 2026 Drift Protocol hack resuming laundering on 20 October 2026. Lookonchain counted 25,700 ETH (about $61.56 million) sent to Tornado Cash in 100 ETH batches, with 81,864 ETH still held. It recaps the six-month fake-VC social engineering, Cursor and VSCode compromise of Security Council devices, and TRM Labs and Chainalysis attribution to DPRK's UNC4736.

Tornado CashEthereumSolana+2
Drift ProtocolUNC4736Citrine Sleet+8

Blockchain, Threat Intel· Published and added 20 Oct 2026

decrypt.coarticle🧠 AI

AI Agents Made 138 Million Crypto Payments in a Year. Most Were Tiny

Decrypt reports on a Chainalysis Geography of Crypto report. It found AI agents made more than 138 million payments through Coinbase's x402 protocol on Base, up from about 1,500 in mid-2025. Over 87% of the payments were between $0.0001 and $0.10, which stablecoins can handle but card rails cannot. US-linked wallets made 88.1% of identifiable inference payments. The article covers agent-payment support from Visa, Mastercard, Stripe, Coinbase and Google, and TRM's caution that much of the activity may be scripts or self-dealing rather than genuine agents.

x402Basestablecoins
ChainalysisCoinbaseVisa+7

agents, ai-policy· Published and added 14 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: Bitget Hack, AI Accord and SEC FAQs

Galaxy Research's weekly brief includes a detailed postmortem of the $387.5M Bitget hack: attackers exploited a zero-day in two unnamed third-party security products ("Product A"/"Product B") to obtain high-level internal credentials, inserted forged withdrawal commands into Bitget's wallet backend across 11 chains, then deleted the fraudulent commands — with Bitget attributing the attack to North Korean actors based on IP behavior and wallet overlaps found by Elliptic and TRM. The piece draws a direct parallel to the $1.5B Bybit/Lazarus heist (compromised Safe{Wallet} infrastructure rather than stolen keys) to argue that private-key cryptography is effectively solved and attackers now target the approval pipeline/intermediary services instead; it also covers the follow-on $3.8M NEAR Intents Omni-bridge exploit and THORChain's continued role laundering DPRK proceeds. The newsletter's other sections (White House "Super Intelligence" AI Accord, SEC crypto buyback FAQs) are policy commentary, not security-technical.

THORChainGnosis Safe
BitgetLazarus GroupDPRK+8

Blockchain, Threat Intel· Added 8 Oct 2026

rekt.newswriteup🛡️ Security

Bitget — Rekt

A rekt.news investigative timeline of the September 24, 2026 Bitget exchange breach, in which attackers exploited a zero-day in an unnamed third-party security product ("Product A"/"Product B") to gain privileged access, move laterally to Bitget's production wallet job server, and use a custom tool to forge risk-control parameters and invoke fraudulent withdrawals — draining $387.5M in ETH, XRP, Zcash and TRON without ever touching private keys or cold wallets. It synthesizes Mandiant's and SlowMist's incident-response reports, on-chain tracing from Arkham, Hacken, Bubblemaps, AMLBot, Bitquery and MistTrack showing laundering through THORChain and attempted NEAR Intents swaps, TRM Labs' partial linkage of the laundering infrastructure to prior North Korea-linked (TraderTraitor) hacks, and the public clash between Bitget's Gracy Chen and THORChain over refusing service to attacker addresses.

EthereumBitcoinXRP+3
BitgetMandiantSlowMist+8

Blockchain, Threat Intel· Added 3 Oct 2026

galaxy.comarticle🛡️ Security

Déjà Vu, Lazarus Crew: $387.5m Bitget Exploit Repeats a Pattern

Galaxy Research post-mortem on the $387.5m Bitget hot/warm wallet theft across 11 chains, attributed to North Korean (Lazarus/DPRK) actors via IP behavior and onchain wallet-overlap analysis by Elliptic and TRM. SlowMist traced the intrusion to a zero-day exploit against two unnamed third-party security vendors ("Product A"/"Product B") that let attackers insert and then delete fraudulent withdrawal commands in Bitget's wallet backend, rather than compromising private keys or cold storage. The piece draws a direct parallel to the February 2025 Bybit/Safe{Wallet} $1.5B theft (doctored signing interface) and the same-week NEAR Intents $3.8m hot-wallet exploit, arguing that private-key cryptography is now reliably secure so attackers instead target the intermediary infrastructure/pipeline that authorizes transactions, with stolen funds repeatedly laundered through THORChain.

THORChainNEAR IntentsGnosis Safe+1
Lazarus GroupDPRKBitget+6

Blockchain, Threat Intel· Added 2 Oct 2026

thehackernews.comarticle🛡️ Security

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

The Hacker News reports Bitget's confirmation that attackers exploited a zero-day vulnerability in unnamed third-party security products ("Product A" and "Product B") to steal $387.5 million in cryptocurrency across 11 blockchains in September 2026. SlowMist's investigation traced the intrusion back to August 31, showing attackers read database credentials via a hidden script, later hijacked an employee identity to inject commands into Product B's management platform, and deployed a web shell with C2 access; Mandiant found the attackers pivoted from the compromised security appliances into Bitget's production wallet job server to deploy a custom withdrawal-draining tool that bypassed risk controls. Bitget, citing IP patterns and on-chain analysis corroborated by Elliptic and TRM Labs, attributes the heist to North Korean threat actors with wallet overlaps linking it to prior laundering operations.

Ethereum
BitgetDPRKSlowMist+6

Blockchain, Threat Intel· Added 2 Oct 2026

decrypt.coarticle🛡️ Security

Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps

Decrypt reports that the attacker behind Bitget's $387.5M hot-wallet theft (Sept. 24) began shielding ~2,700 ZEC (~$3.8M) in Zcash's new Ironwood privacy pool, per on-chain investigator ZachXBT. Bitget's CEO and Elliptic attribute the heist to North Korea, and TRM Labs traced laundering through round-number wallet splits and cross-chain swap services including Thorchain, Across, Bridgers, Chainflip, and FixedFloat. Near Intents' SHIELD screening blocked over $50M in related swaps while Thorchain refused to selectively halt the attacker's addresses, spotlighting the gap between blockchain "permissionless" design and real-time sanctions/freeze response during active exchange-hack laundering.

ZcashTHORChain
ZachXBTTRM LabsElliptic+3

Blockchain· Published and added 30 Sep 2026

huntress.comwriteup🛡️ Security

How Threat Actors Abuse Remote Management Tools | Huntress

Huntress details how low-skill threat actors daisy-chain legitimate RMM tools (ScreenConnect, Action1, HeartbeatRM, AnyDesk, Atera, etc.) via invitation and Social Security themed lures, LLM-generated infostealer scripts, and multi-fallback browser download tricks hosted on GitHub repos (VH851, Drasticc) to gain and disguise persistent access. It also documents firsthand observation of an actor who signed up to Huntress itself, revealing their toolchain (DeepSeek, Email Extractor, Proxy SwitchyOmega, 9Proxy, CertifyTheWeb, Sordum Hide from Uninstall List, and a fake Windows Security PIN harvesting binary pin.exe) and victim data such as W-9 forms and SSNs collected via Telegram based exfiltration.

ScreenConnectAction1HeartbeatRM+3
VH851Drasticcpin.exe+3

Threat Intel, Offensive Security· Added 3 Sep 2026, published 11 Mar 2026