[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f1ATvyU4UoEgOpyWv4ph7idq1eZnu1bAzeTQRWDO0OSw":3},{"article":4,"iocs":53,"watch_terms":64,"solutions":65,"lesson":147},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"df6a9651-9ff5-4e23-a4e8-31c593da1165","US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist","us-freezes-2-7-billion-stolen-by-north-korean-hackers-in-massive-6-billion-binan-41ddad","The US government has frozen more than $2.7 billion of the crypto stolen from Binance on or about October 29, 2026. The FBI says North Korea took over $6 billion in that theft. Court orders already allow US officials to seize or hold more than $1.2 billion of the frozen funds. The Justice Department announced […] The post US Freezes $2.7 Billion Stolen by North Korean Hackers in Massive $6 Billion Binance Crypto Heist appeared first on Cyber Security News.","The US government has frozen over $2.7 billion in cryptocurrency stolen from Binance in a heist attributed to North Korea, which the FBI estimates took more than $6 billion. The Justice Department announced the action, noting that court orders allow for the seizure of over $1.2 billion of the frozen funds. The FBI blames the North Korean group TraderTraitor for the Binance theft, stating that thieves primarily convert stolen funds to Ethereum and use DeFi tools and instant swap services to obscure their trail.","US freezes $2.7B in crypto stolen by North Korean hackers from Binance.","https:\u002F\u002Fcybersecuritynews.com\u002Fus-freezes-2-7-billion\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FUS-Freezes-2.7-Billion-Stolen-by-North-Korean-Hackers-in-Massive-6-Billion-Binance-Crypto-Heist-1.webp","2026-11-13T10:56:15+00:00","2026-11-13T11:00:31.86801+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"TraderTraitor","threat_actor",{"name":21,"type":19},"Sapphire Sleet",{"name":23,"type":19},"UNC1069",{"name":25,"type":19},"BlueNoroff",{"name":27,"type":19},"APT38",{"name":29,"type":19},"Stardust Chollima","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,58,60,61,62,63],{"type":55,"value":56,"context":57},"malware","FaceStealer","North Korean scam operation targeting victims with fake video calls and malware.",{"type":55,"value":21,"context":59},"Threat group blamed for the FaceStealer campaign.",{"type":55,"value":23,"context":59},{"type":55,"value":25,"context":59},{"type":55,"value":27,"context":59},{"type":55,"value":29,"context":59},[],{"controls":66,"vendors":146},[67,96,117],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[101,109],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":118,"name":119,"problem":120,"products":121},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[122,130,138],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",[],{"slug":148,"title":149,"body":150,"framework_refs":151,"framework_notes":157},"north-korean-hackers-steal-6b-from-binance-using-crypto-obfuscation-chains","North Korean Hackers Steal $6B from Binance Using Crypto Obfuscation Chains","The North Korean threat group TraderTraitor executed a massive cryptocurrency heist attributed to Binance, stealing over $6 billion and laundering funds through Ethereum conversions, DeFi protocols, and instant swap services to obscure the trail. The sophistication of the laundering technique — layering transactions across decentralized platforms — highlights how inadequate blockchain transaction monitoring and weak anti-money-laundering controls can allow stolen assets to disappear quickly. By the time authorities froze $2.7 billion, a significant portion of the stolen funds had already been successfully laundered. This incident underscores the critical importance of real-time transaction monitoring, anomaly detection, and international cooperation in cryptocurrency platforms to detect and respond to large-scale theft before funds are irreversibly dispersed.",[152,153,154,155,156],"MITRE ATT&CK T1565: Data Manipulation","NIST CSF 2.0 DE.CM-01: Monitoring","NIST SP 800-53 SI-4: System Monitoring","CIS Control 13: Network Monitoring and Defense (v8)","NIS2 Article 21(2)(b)",{"NIS2 Article 21(2)(b)":158,"NIST CSF 2.0 DE.CM-01: Monitoring":159,"MITRE ATT&CK T1565: Data Manipulation":160,"NIST SP 800-53 SI-4: System Monitoring":161,"CIS Control 13: Network Monitoring and Defense (v8)":162},"NIS2 requires effective incident handling procedures; a faster, well-rehearsed incident response to the initial theft could have enabled earlier asset freezing and reduced total losses.","Continuous monitoring of network and financial transaction activity would have provided earlier detection of the abnormal large-scale fund movements central to this heist.","TraderTraitor manipulated the flow of stolen funds through layered DeFi transactions and instant swaps specifically to alter the traceable state of assets and evade attribution.","Robust system and transaction monitoring controls would have flagged the high-volume, anomalous transfer patterns used by TraderTraitor before funds were converted and obscured.","Monitoring and defending network-level data flows — extended here to blockchain transaction flows — would have enabled faster detection of the coordinated theft activity."]