ACRIP Command Center

PRODUCTIONNeon main٠٧:٠٦ م

Canonical Run ID

ACRIP-TAI-20261101T101330Z-B8C4D2E1

ناجح · PASS

What ran?GENERAL_DISCOVERY

Select the freshest/highest-impact non-duplicate threat-actor/infrastructure development using freshness + technical impact + evidence strength + real-world exploitation + defensive value; enforce identity/provenance/negative-space gates.

Why this Topic?TraderTraitor — Binance US$6.3B+ Theft, Cross-Chain Extraction & Laundering Infrastructure

NEW_TOPIC_RUN_SCOPED

Confidenceغير مسجل

Research result: PASS

HOT_STARTغير مسجلDISCOVERYغير مسجلVALIDATIONغير مسجلDEDUPEغير مسجلCOMMITPASSREADBACKPASSCLOSUREPASS

Domain: Threat Actor & Infrastructure Research
Run date: ٠١‏/١١‏/٢٠٢٦، ٣:٠٠ ص
Last verified: غير مسجل
Prior memory: محمّلة
Source status: CLOSED
Publication: RESEARCH_MORE

Selected TraderTraitor/Binance US$6.3B+ theft and active cross-chain laundering infrastructure. FBI attribution, Binance victim disclosure, TRM/Elliptic on-chain evidence and Nov-1 recovery state verified; preliminary root cause and alias overreach kept gated.

EVIDENCE

الأدلة وما تثبته

7 سجل

Supports: TAI-H-B8C4D2E1-01,TAI-H-B8C4D2E1-02
Does not prove: Does not establish exact initial access, every derived address, or equivalence with unrelated DPRK clusters.
Confidence: غير مسجل
Context: TraderTraitor

FBI Cyberفتح المصدرCY-T1 / Government Law-Enforcement Attribution

Supports: TAI-H-B8C4D2E1-03,TAI-H-B8C4D2E1-04
Does not prove: Does not independently attribute actor or establish the laptop as sole root cause.
Confidence: غير مسجل

CONTRADICTIONS

التناقضات والقيود

لا توجد تناقضات مسجلة لهذه الجولة.

UNCERTAINTY

الفجوات غير المحسومة

{"Notes":"Preserve UNKNOWN until final sequence.","Gap ID":"CY-GAP-TAI-B8C4D2E1-01","Impact":"Blocks definitive root-cause/prevention claim.","Status":"OPEN","Gap Type":"INITIAL_ACCESS_ROOT_CAUSE","Priority":"HIGH","Domain ID":"CY-DOM-008","Topic IDs":"CY-TOP-TAI-B8C4D2E1","Description":"Complete initial-access and privilege/authorization chain remains unresolved; compromised-laptop hypothesis is preliminary and additional breach points exist.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-TAI-20261101T101330Z-B8C4D2E1","Required Evidence / Resolution":"Final Binance postmortem; endpoint/identity/service-container authorization logs and timeline."}
{"Notes":"Static IOC list decays quickly.","Gap ID":"CY-GAP-TAI-B8C4D2E1-02","Impact":"Blocks durable static-IOC ownership and complete laundering/recovery conclusions.","Status":"OPEN","Gap Type":"LAUNDERING_GRAPH_CONTINUITY","Priority":"HIGH","Domain ID":"CY-DOM-008","Topic IDs":"CY-TOP-TAI-B8C4D2E1","Description":"Actor-controlled vs intermediary status, derived-address lineage, freeze/recovery state and service attribution are changing in real time.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-TAI-20261101T101330Z-B8C4D2E1","Required Evidence / Resolution":"Fresh blockchain analytics; provider attribution; sanctions/freeze actions; time-bounded transaction graph."}

FOLLOW-UP

المتابعات غير المحسومة

3 مفتوحة

Priority: HIGH · Created: ٠٣‏/١١‏/٢٠٢٦، ١:١٣ م

Priority: MEDIUM-HIGH · Created: ٠٣‏/١١‏/٢٠٢٦، ١:١٣ م

AUDIT TIMELINE

السجل الزمني الكامل

0 حدث

لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.

PERSISTENCE / READBACK

سلامة الالتزام والـReadback

Commit

ACRIP-COMMIT-TAI-B8C4D2E1

COMMITTED · Readback PASS

SELF

SnapshotACRIP-SNAP-TAI-B8C4D2E1

Integrity: PASS · غير مسجل

Evidence 14 · Hypotheses 8 · Runs 2

Payload fingerprint

5162124c4c898d720f20b009268283331c5f0b67dcf9a43c2bd26da478c76305

Canonical persistence

Commit: PASS · Readback: PASS · Closure: PASS

PASS — atomic canonical commit/readback exact; Hot-Start affected-slice refresh/readback PASS (4 hypotheses, 3 gaps, 1 watch, 1 run, 1 topic head, Domain Head updated); Commit ACRIP-COMMIT-TAI-B8C4D2E1 COMMITTED/PASS; protected Core root 597ca514575a926e202096be60f1a040dd63bfbb99ae07f7bf6d061e482c6b2c unchanged. Run package: https://docs.google.com/document/d/1f49-AcrSEg5nm2_MzAR-COIZSWjLwP3cxDm3qXPYXa0/edit

Drive Run Domain Store

العودة إلى سجل الجولات

تدقيق الجولة

الأدلة وما تثبته

FBI attributes the >US$6B Binance theft on/about 2026-10-29 to DPRK activity tracked as TraderTraitor and publishes laundering addresses/expected ETH-DeFi-swap path.

Binance confirms ~US$6.3B unauthorized withdrawals; initial laptop hypothesis was followed by additional breach points; no evidence wallet private keys leaked; full sequence pending.

التناقضات والقيود

الفجوات غير المحسومة

المتابعات غير المحسومة

INITIAL_ACCESS_ROOT_CAUSE

LAUNDERING_GRAPH_CONTINUITY

ALIAS_OPERATION_BOUNDARY

السجل الزمني الكامل

سلامة الالتزام والـReadback

TRM attributes the attack to TraderTraitor with high confidence; ~US$6.36B moved across ten chains, mostly in ~20 minutes; Ethereum used EIP-7702 sweeper with 50 pre-signed authorizations, other chains ordinary signed transfers.

Elliptic measured ~US$6.43B across 11 chains, assessed DPRK-linked actors likely responsible, linked some proceeds to prior suspected DPRK proceeds and verified ~US$2.84B frozen at its measurement time.

At 2026-10-31 08:48 UTC Elliptic observed ~US$93.5M fan-out from a main Tron distribution wallet to ~150 wallets with repeated top-ups and accelerating movement.

FBI and partners say TraderTraitor activity is also tracked as Jade Sleet, UNC4899 and Slow Pisces and document a prior DMM/Ginco targeted-social-engineering/session-abuse chain.

On 2026-11-01 Binance began phased withdrawal restoration after security/readiness checks, continued residual-risk monitoring and recovery, reported ~95% asset replenishment, and said a post-incident report remains forthcoming.