A Fake Job Interview and a Swapped pyenv Opened Binance’s Vault

The $6.34 billion Binance theft started with a fake job interview and a booby-trapped copy of a Python version manager. ReversingLabs has mapped the intrusion chain Binance disclosed on Nov. 3 to ATT&CK: three engineers compromised over five months, ending in a container that reached the wallet signing service on Oct. 29. The FBI has since attributed the theft to North Korea’s TraderTraitor. Binance still hasn’t published hashes, domains or IPs for the implant, so RL also profiles a separate TraderTraitor toolkit that uses the same interview lure and ships published detection rules. (Our first story: how the theft unfolded.)

registry[.]hashicorp-terraform[.]io (lookalike Terraform registry)
diagnose[.]hashicorp-terraform[.]io (loader download host)
registry[.]hashicorp-aws[.]com (lookalike Terraform registry)
registry[.]hashicorp-aws[.]io (lookalike registry, per SentinelOne)
supportaru[.]serveftp[.]com (FLATROOF payload host)
stage-fashion365[.]vercel[.]app (FLATROOF payload backup)
arusupport-region1-webhook[.]online (FLATROOF C2)
technicais[.]sytes[.]net (ROOFDECK download host)
storage[.]hubpage[.]cloud (toolset infrastructure, per SentinelOne)

/opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_ (Binance pyenv staging file)
terraform-provider-awsbeta_v1.0.0 SHA256 188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666
safari_updater loader SHA256 451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97
HiraginoSans-Regular.woff container SHA256 62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38
FLATROOF SystemUpdate SHA256 3c254614de8c1a2f213c526b0e5072d43ffeb7cc340d9a4a6ebaa16592b3bbe0

Source article: Binance heist: a fake interview, a trojanized pyenv, and what RL sees
Publisher: ReversingLabs
Published: Oct. 31, 2026, updated Nov. 4, 2026
URL: https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit

Executive Summary

TraderTraitor, the financially motivated North Korean cluster within the Lazarus umbrella that is also tracked as Jade Sleet, UNC4899, Slow Pisces and Pressure Chollima, is attributed by the FBI to the Oct. 29, 2026 theft of about $6.34 billion from Binance hot wallets, following its DMM Bitcoin (2024) and Bybit (2025) thefts. Per Binance’s Nov. 3 initial findings as summarized by ReversingLabs, three engineers were compromised over five months: in June a search for an AI coding tool led Engineer A to a tampered Homebrew install that exposed A’s role and colleagues; in September a fake “Project Director,” fake HR and a fake “CEO” of a non-existent company persuaded Engineer B to run an interview “assignment” repository whose setup replaced Homebrew’s pyenv with an obfuscated malicious copy that contacted attacker infrastructure and removed its traces without endpoint detection; on Oct. 20 the attacker used an internal AI tool to take control of Engineers A and C, found a container-deployment token on A’s machine, and on Oct. 29 a container reached the wallet signing service, where about 50 signing transactions set EIP-7702 delegations that gave attacker contract code partial control of MPC hot wallets before funds were drained over roughly four hours. Binance has published no malware family, hashes, domains or IPs for the pyenv implant, so ReversingLabs also profiles a separate 2026 TraderTraitor toolset (per Zscaler and SentinelOne) that uses the same interview lure: a weaponized Terraform lock file, a trojanized terraform-provider-awsbeta, a Bash loader, a WOFF font container carrying the FLATROOF backdoor, and the ROOFDECK backdoor in circulation since 2025; no source links that toolset to Binance. The objective is large-scale cryptocurrency theft through developer and DevOps workstations. Hunt leads, false positive expectations, the published Sigma and YARA rules and the indicators are detailed below.

ATT&CK chain: Reconnaissance → Initial Access → Execution → Persistence → Defense Evasion → Credential Access → Lateral Movement → Command and Control → Impact

Hunt Lead Grid

TraderTraitor Terraform Toolset Infrastructure and Hash Sweep

In the Terraform variant of TraderTraitor’s interview lure, documented by SentinelOne (Sept. 18) and Zscaler (Oct. 8) and re-checked by ReversingLabs, a DevOps candidate runs terraform init on an interview project whose .terraform.lock.hcl points at a lookalike registry such as registry[.]hashicorp-terraform[.]io or registry[.]hashicorp-aws[.]com (SentinelOne also lists registry[.]hashicorp-aws[.]io). The trojanized terraform-provider-awsbeta_v1.0.0, a real AWS provider with a small malicious package compiled in, writes a run-once session.lock marker, downloads a Bash script from diagnose[.]hashicorp-terraform[.]io, saves it as safari_updater and runs it detached. The loader tries supportaru[.]serveftp[.]com, then a GitHub mirror under the bluearuhost account, then stage-fashion365[.]vercel[.]app, for a WOFF font that hides FLATROOF; FLATROOF calls home to arusupport-region1-webhook[.]online and installs ROOFDECK, whose iSync build was downloaded from technicais[.]sytes[.]net and which reads its C2 address from a Nostr profile with a Pastebin dead drop as fallback. SentinelOne’s victim had the implants on disk by March 18, 2026. The detection logic is a retrospective sweep of DNS, proxy and firewall logs for those hosts (the full subdomain, never serveftp.com, sytes.net, vercel.app or github.com as a whole) and an EDR file sweep for the hashes in the Hash Appendix.

Use DNS resolver and proxy logs, EDR file inventory and macOS unified logs from developer, DevOps and build machines. Sweep back to at least September 2025, since RL first saw the Windows ROOFDECK build on Sept. 9, 2025 and the provider on July 23, 2026, 77 days before the public write-ups. Scope first to anyone who has run Terraform on a personal or interview project, then to every host that holds cloud or deployment credentials. Don’t block github.com, raw.githubusercontent.com, vercel.app or pastebin.com outright, since developers need them; block only the attacker paths and subdomains, and treat the dynamic-DNS hosts as attacker-owned subdomains. RL warns that pivots on two related domains are noisy because they appear in hundreds of goodware feed files; those are not included here. Any hit on these hosts or hashes means the machine ran the lure: isolate it and rotate every credential it held. None of these indicators is a confirmed Binance indicator.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer); Initial Access → T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools) (T1195.001 per the source’s Sigma rule tags; T1105 our mapping)

Sources: “Binance heist: a fake interview, a trojanized pyenv, and what RL sees”, ReversingLabs, Nov. 4, 2026, https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit (source article)

FLATROOF Font Container YARA Sweep

The Bash loader downloads a file that presents as a WOFF web font (RL holds the macOS ARM64 HiraginoSans-Regular.woff): decoy font data, then an @@ENDFONT@@ marker, then a Base64-encoded, AES-256-CBC-encrypted executable. RL read the loader and says it splits the file at the marker, decrypts with OpenSSL using legacy MD5 key derivation and a hardcoded passphrase, strips the quarantine attribute, ad-hoc signs the result and launches it with –type=renderer so it passes for a Chromium renderer process. The decrypted payload is a 2.3 MB arm64 Rust Mach-O installed as SystemUpdate, the backdoor Zscaler calls FLATROOF and SentinelOne calls macOS.Gaslight. RL pairs two YARA rules: one for a WOFF file carrying the marker and a long Base64 run, one for a small non-WOFF script that references both the marker and a .woff file. The detection logic is to run both rules across file stores, mail and web gateway captures, and EDR file collections from macOS developer hosts.

Run the rules in retro-hunt mode over whatever file corpus you have and as a scan on macOS endpoints in developer and DevOps roles; RL advises testing against a corpus of web fonts before production, and for more precision requiring @@ENDFONT@@U2FsdGVkX1 (marker plus OpenSSL salt header) at the cost of missing variants. Sweep from early 2026 forward. RL’s own retro hunt matched the two known samples and two WOFF files first seen Oct. 9 that it classifies as goodware and cannot decrypt; RL treats those as possible containers and hunting leads, not IOCs, and so should you. Don’t rely on font names or file names, which are trivially changed; the marker is what the loader depends on, so a variant that drops it must also change the loader. Any match outside a test corpus should be escalated and the host checked for a SystemUpdate binary and a recent ad-hoc signed process launched with –type=renderer outside a browser.

rule RL_TraderTraitor_FlatroofFontContainer_2026 {
    meta:
        description = "WOFF file carrying an appended @@ENDFONT@@ marker and Base64 payload, as used to stage FLATROOF"
        author      = "[RL researcher], ReversingLabs"
        date        = "2026-10-31"
        reference   = "https://www.reversinglabs.com/blog/[post-slug]"
        hash        = "62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38"
        score       = 85
    strings:
        // Delimiter between decoy font data and the encrypted payload
        $marker = "@@ENDFONT@@" ascii
        // Base64 run that follows the marker (long, no whitespace)
        $b64 = /@@ENDFONT@@[A-Za-z0-9+\/]{512}/ ascii
    condition:
        uint32be(0) == 0x774F4646        // "wOFF"
        and filesize < 20MB
        and $marker and $b64
}

rule RL_TraderTraitor_FlatroofLoader_Script_2026 {
    meta:
        description = "Shell loader that splits a .woff file at the @@ENDFONT@@ marker to recover the FLATROOF payload"
        author      = "[RL researcher], ReversingLabs"
        date        = "2026-10-31"
        reference   = "https://www.reversinglabs.com/blog/[post-slug]"
        hash        = "451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97"
        score       = 75
    strings:
        $marker = "@@ENDFONT@@" ascii
        $woff   = ".woff" ascii
    condition:
        uint32be(0) != 0x774F4646 and filesize < 200KB
        and $marker and $woff
}

(YARA rules reproduced as published by ReversingLabs, including the placeholder author and reference fields that appear in the published post.)

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Defense Evasion → T1027.013 (Obfuscated Files or Information: Encrypted/Encoded File) (our mapping)

Sources: “Binance heist: a fake interview, a trojanized pyenv, and what RL sees”, ReversingLabs, Nov. 4, 2026, https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit (source article)

Homebrew pyenv Replaced via Staging File

Binance published the file operations from Engineer B’s Mac, though no hash: the interview repository’s setup wrote 3,414 bytes of malicious content to a staging file, /opt/homebrew/Cellar/pyenv/2.8.0/libexec/pyenv_, next to the real pyenv; the legitimate 3,344-byte libexec/pyenv was removed and replaced by the renamed staging file; and the /opt/homebrew/bin/pyenv symlink was deleted and recreated, followed by a zsh spawn. Because pyenv runs every time a developer switches Python versions, the replacement gives the attacker repeated execution in the developer’s shell. RL’s Sigma rule looks for creation of a pyenv_ file under the Homebrew pyenv libexec directory (both /opt/homebrew/Cellar/pyenv/ and /usr/local/Cellar/pyenv/) by any process other than brew. The detection logic is that rule plus, where file events are thin, an EDR correlation: a rename onto libexec/pyenv by a process that isn’t brew, the bin/pyenv symlink deleted and recreated within seconds, and a zsh child right after.

Use macOS EDR file events (Endpoint Security framework create, rename and unlink) and process creation. Sweep back to at least September 2026 for Binance-style activity and further for any developer who took outside interviews. Scope to every Mac with Homebrew and pyenv, prioritizing engineers with production, wallet or deployment access. Don’t hash-block pyenv: the legitimate script changes with every release, and the attacker’s copy isn’t public; anchor on the staging name and the non-brew writer instead. Also compare libexec/pyenv against the size and checksum of the Homebrew bottle for the installed version, which catches a replacement even if the staging step is renamed. A hit means an attacker had code execution in a developer’s shell: escalate, isolate the Mac and rotate everything that shell could reach. The approach generalizes to any trojanized CLI tool in a package-manager prefix.

title: Homebrew pyenv Executable Staged and Replaced via pyenv_ File
id: 9c3e5b7a-2f41-4d8e-b6a0-7e1c4d2f8a63
status: experimental
description: Detects creation of a pyenv_ staging file in the Homebrew pyenv libexec directory, the first step of the pyenv replacement Binance disclosed for its October 2026 intrusion
references:
    - https://www.reversinglabs.com/blog/[post-slug]
author: [RL researcher], ReversingLabs
date: 2026-11-04
tags:
    - attack.persistence
    - attack.t1554
    - attack.execution
    - attack.t1204.002
logsource:
    product: macos
    category: file_event
detection:
    selection:
        TargetFilename|endswith: '/libexec/pyenv_'
        TargetFilename|contains:
            - '/opt/homebrew/Cellar/pyenv/'
            - '/usr/local/Cellar/pyenv/'
    filter_brew:
        Image|endswith: '/brew'
    condition: selection and not filter_brew
falsepositives:
    - Manual pyenv patching by a developer (rare)
level: high

(Sigma rule reproduced as published by ReversingLabs, including its placeholder fields.)

Hunt Lead Level: 2 (Pro)

ATT&CK: Persistence → T1554 (Compromise Host Software Binary); Execution → T1204.002 (User Execution: Malicious File) (mapping per source article)

Sources: “Binance heist: a fake interview, a trojanized pyenv, and what RL sees”, ReversingLabs, Nov. 4, 2026, https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit (source article)

Terraform Provider Spawning a Shell or Downloader

In the Terraform lure, the malicious work happens inside the provider plugin process that terraform init and terraform plan launch: the trojanized terraform-provider-awsbeta downloads safari_updater with a network utility, runs it detached through a shell, and the loader then calls openssl to decrypt the payload, xattr to strip quarantine and codesign to ad-hoc sign it. RL classifies the provider as malicious (MacOS.Trojan.Multiverze, 7 of 24 scanners) and notes that its functional similarity hash clusters it with 16 legitimate AWS provider builds, so structure-based allowlisting will wave it through. RL’s Sigma rule fires when a process whose image path contains /terraform-provider- launches sh, bash, zsh, curl, openssl, xattr or codesign. A second, near-zero-noise check is static: any .terraform.lock.hcl or provider source that references a registry other than registry.terraform.io or your own private registry.

Use macOS EDR process creation with parent image paths, and duplicate the rule with product: linux for Linux build hosts as RL suggests; on Windows, alert on a terraform-provider-*.exe parent spawning powershell.exe, cmd.exe or curl.exe. Add a repository and file-system scan for lock files pointing at non-HashiCorp registries, run in CI and on developer machines. Sweep back to early 2026 (SentinelOne’s victim had implants by March 18). Scope to developer, DevOps and CI hosts. Allowlist known community providers that shell out by provider name and signer, never by the child process alone. Blocking Terraform or the public registry is the wrong control; pinning providers to trusted registries and reviewing lock files in code review is the right one. A hit from an unknown provider should be escalated as a likely compromise of the host and its cloud credentials. The pattern generalizes to any malicious plugin or dependency that executes during a build tool’s init step.

title: Terraform Provider Plugin Spawning Shell or Network Utility
id: 4f2a9c61-8b3e-4d7a-9e15-2c6d0b7f3a18
status: experimental
description: Detects a Terraform provider plugin process launching a shell, curl or decryption tooling, as seen with the trojanized terraform-provider-awsbeta used to deliver FLATROOF
references:
    - https://www.reversinglabs.com/blog/[post-slug]
author: [RL researcher], ReversingLabs
date: 2026-10-31
tags:
    - attack.execution
    - attack.t1059.004
    - attack.initial_access
    - attack.t1195.001
logsource:
    product: macos
    category: process_creation
detection:
    selection_parent:
        ParentImage|contains: '/terraform-provider-'
    selection_child:
        Image|endswith:
            - '/sh'
            - '/bash'
            - '/zsh'
            - '/curl'
            - '/openssl'
            - '/xattr'
            - '/codesign'
    condition: selection_parent and selection_child
falsepositives:
    - Community providers that legitimately shell out (rare; review and allow-list by provider name and signer)
level: high

(Sigma rule reproduced as published by ReversingLabs, including its placeholder fields.)

Hunt Lead Level: 2 (Pro)

ATT&CK: Initial Access → T1195.001 (Supply Chain Compromise: Compromise Software Dependencies and Development Tools); Execution → T1059.004 (Command and Scripting Interpreter: Unix Shell) (mapping per source article)

Sources: “Binance heist: a fake interview, a trojanized pyenv, and what RL sees”, ReversingLabs, Nov. 4, 2026, https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit (source article)

Workstation Deployment Token Reaching the Signing Path

The decisive step at Binance wasn’t malware but credentials: from Engineer B’s machine the attacker used an internal AI tool to take control of Engineers A and C on Oct. 20, found a container-deployment token stored on A’s machine, logged on to C’s machine with A’s credentials, deployed a container, and on Oct. 29 a script in that container reached the wallet signing service, where about 50 signing transactions manipulated nonces and set EIP-7702 delegations. RL notes the same arc in TraderTraitor’s DMM Bitcoin and Bybit thefts per the FBI: stolen sessions, cloud credentials and shell history give authenticated access without defeating MFA. The detection logic joins three sources: a deployment or cloud token used from a workstation rather than CI, a container or workload created by that identity that is new to the environment, and that workload connecting to a signing, custody or payment service; a fourth, chain-side signal is any EIP-7702 delegation set on a wallet you operate, with a batch of authorizations across consecutive nonces treated as a compromise indicator, per RL.

Use container platform and cloud audit logs (deployments with the source IP and token identity), identity provider sign-in logs, network flow or service-mesh logs in front of signing services, and on-chain monitoring of your own wallets. Baseline which tokens are ever used from engineer devices and which workloads are allowed to talk to the signing path; the lead depends on that allowlist being maintained. Sweep back at least 90 days, since Binance’s chain ran five months. Scope to identities with deployment rights in environments that can reach money-moving systems. Tuning by suppressing workstation token use is the wrong fix; RL’s guidance is to get deployment tokens off laptops entirely and to prepare EIP-7702 revocation for MPC wallets in advance, since no single key could revoke quickly at Binance. A correlated hit should page incident response immediately, not wait for review. The lead generalizes to any environment where a developer credential can create workloads near production secrets.

Hunt Lead Level: 3 (Elite)

ATT&CK: Credential Access → T1552.001 (Unsecured Credentials: Credentials In Files); Credential Access → T1528 (Steal Application Access Token) (mapping per source article, which marks the lateral-movement step’s mapping as likely)

Sources: “Binance heist: a fake interview, a trojanized pyenv, and what RL sees”, ReversingLabs, Nov. 4, 2026, https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit (source article)

Hash Appendix

Terraform lure toolset (not linked to Binance)

All three hash types from the source article (ReversingLabs’ IOC table). The Binance pyenv implant has no published hashes.

MD5s
9d78ece09457907b730d139e4e0c64dd  # terraform-provider-awsbeta_v1.0.0 -> trojanized Terraform provider (MacOS.Trojan.Multiverze)
73adaea97f003735335505858c1c6def  # safari_updater -> Bash loader fetched from diagnose[.]hashicorp-terraform[.]io
be60c52ca8a01fef7dc15c2f0ebb77d8  # HiraginoSans-Regular.woff -> FLATROOF font container (macOS ARM64)

SHA1s
8473f85bda00dfa3ecd2385dd38f69600d1d64a6  # terraform-provider-awsbeta_v1.0.0 -> trojanized Terraform provider (MacOS.Trojan.Multiverze)
d81081691c3631f3adc1a6db0ee22ab19682ef30  # safari_updater -> Bash loader fetched from diagnose[.]hashicorp-terraform[.]io
4402e44c0bc959ac22340041413de2482e8b5d53  # HiraginoSans-Regular.woff -> FLATROOF font container (macOS ARM64)

SHA256s
188bd4fc222c9615540884920caf37ea88bcbea7488e1fb98709e357dd096666  # terraform-provider-awsbeta_v1.0.0 -> trojanized Terraform provider (MacOS.Trojan.Multiverze)
451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97  # safari_updater -> Bash loader fetched from diagnose[.]hashicorp-terraform[.]io
62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38  # HiraginoSans-Regular.woff -> FLATROOF font container (macOS ARM64)

Zscaler-published font containers RL does not hold (MD5 only, from the source article): 116f7189ed7b41f1b339a749d56e63be, 58fa0d651898446d5f5d2ed8a27a3330, 2621753691be9521288664bb551dfba6, ad0b1b6d2c8b9d09d6473a4a299470ab, 4b8509cde757b5428e5f99c8dffe73ca, 3826dc7a9ba8bd5b1c143560c1530d89, 34a52e6a4d803e94fe497bab682abfd3.

FLATROOF and ROOFDECK backdoors

All three hash types from the source article. Builds labeled “likely FLATROOF” are RL similarity matches not named in any public report.

MD5s
dfa191ca6817ec56e6986e728b323f92  # SystemUpdate -> decrypted FLATROOF, Rust Mach-O (MacOS.Trojan.Gaslight)
2b81aceab0142472d94eb42e500b27b1  # imagent -> macOS ROOFDECK
9d88b4494c7bc27b10358b68a899ad54  # update.exe -> Windows ROOFDECK, RL first seen 2025-09-09
c43f594fac7544e5485cbbe441e470bf  # loginwindow -> stripped ROOFDECK (published by SentinelOne)
d95dede4387ff516f4c23351c450427d  # iSync -> ROOFDECK, downloaded from technicais[.]sytes[.]net
c586e6be49105a23af8f306b560e35e6  # likely FLATROOF build -> RL first seen 2026-06-24
0864185c7ed85627cd755f41ffa91656  # likely FLATROOF build -> RL first seen 2026-08-07
47e5d544dffbd92f771377f4ee8f8428  # likely FLATROOF build -> RL first seen 2026-10-09
643e0c68cb56e0b794204a07112149ed  # likely FLATROOF build -> RHA sibling of decrypted payload, RL first seen 2026-10-09
3da00848071e2f17c84b357fd34b5814  # likely FLATROOF build -> RL first seen 2026-10-11

SHA1s
13888e384b2747758aca2e42dee7dc63393b9f57  # SystemUpdate -> decrypted FLATROOF, Rust Mach-O (MacOS.Trojan.Gaslight)
93c655963d7dd6cac017d9a59f54f7cee196fc89  # imagent -> macOS ROOFDECK
0b7ca6630ea1e66b7d96f3adf2a3e25b08fc1e92  # update.exe -> Windows ROOFDECK, RL first seen 2025-09-09
5728b11d30586bbfc1d8bd12df1c722a06e767a2  # loginwindow -> stripped ROOFDECK (published by SentinelOne)
c491d477dbe0ae04e9aed9dbe237144c03f73ec4  # iSync -> ROOFDECK, downloaded from technicais[.]sytes[.]net
1948f50831621e1a016a3bf3b068e3897ec70866  # likely FLATROOF build -> RL first seen 2026-06-24
7bf5bd537e56d1622a2062c8230dae4a2b0c9a6d  # likely FLATROOF build -> RL first seen 2026-08-07
119bcd39e28dee20ad6762c4d640a8c586cfe23e  # likely FLATROOF build -> RL first seen 2026-10-09
1798c89acb758ed69e03a08d05d3790dfece00d3  # likely FLATROOF build -> RHA sibling of decrypted payload, RL first seen 2026-10-09
de43b28a9a3c85a429f81aed07c0e13c4112800b  # likely FLATROOF build -> RL first seen 2026-10-11

SHA256s
3c254614de8c1a2f213c526b0e5072d43ffeb7cc340d9a4a6ebaa16592b3bbe0  # SystemUpdate -> decrypted FLATROOF, Rust Mach-O (MacOS.Trojan.Gaslight)
4ba58fba8e1293e1d980726323bda0fcd3cc1e5781a99e86638a4a7641b6ffd6  # imagent -> macOS ROOFDECK
e1c71374814e5d907afb913108090b8abf21ae2131c0880f013a3b9108a9d0fc  # update.exe -> Windows ROOFDECK, RL first seen 2025-09-09
f3404ef308098202246f2f3c38c8c3166e9a8e7843ec69c1b11ac0ce9cb4038e  # loginwindow -> stripped ROOFDECK (published by SentinelOne)
77b4fd46994992f0e57302cfe76ed23c0d90101381d2b89fc2ddf5c4536e77ca  # iSync -> ROOFDECK, downloaded from technicais[.]sytes[.]net
6328567511d88fdc2ae0939c5ef17b7a63d2a833881900de018a4f12f4982525  # likely FLATROOF build -> RL first seen 2026-06-24
41adffbceec976d0b485d72f81427d20a8781c383744e659b68cdd7acaaf9f05  # likely FLATROOF build -> RL first seen 2026-08-07
82cf467cf31f152e1a2e03b1774dd863edc02772b4f41960425e836c4d441354  # likely FLATROOF build -> RL first seen 2026-10-09
f302bbd20c9b6f805f139b76f7514ac9817c62903722eb926b8d8d33dd724077  # likely FLATROOF build -> RHA sibling of decrypted payload, RL first seen 2026-10-09
ad9531866c82780b32c7b2cbdd28a7e39422d2101e83791be86e4fc011379a43  # likely FLATROOF build -> RL first seen 2026-10-11

References Appendix

• “Binance heist: a fake interview, a trojanized pyenv, and what RL sees”, ReversingLabs, Oct. 31, 2026, updated Nov. 4, 2026, https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit (source article; Binance’s disclosed chain, attribution summary, Terraform toolset analysis, Sigma and YARA rules, indicators)
• “FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com”, FBI, https://www.fbi.gov/news/press-releases/fbi-dc3-and-npa-identification-of-north-korean-cyber-actors-tracked-as-tradertraitor-responsible-for-theft-of-308-million-from-bitcoindmmcom (cited by the source article for TraderTraitor’s earlier operations)
• MITRE ATT&CK Enterprise technique pages linked above, MITRE, https://attack.mitre.org/