# Binance heist: what we know, and what RL sees in TraderTraitor's toolkit

Fake-recruiter repo trojanized a Terraform provider to backdoor a Binance engineer's workstation, letting attackers reach wallet signing and steal ~$6.34B.

- Payout: Real-world hack
- Severity: critical
- Program: Binance
- Analysis by: Igor Lasic
- Disclosed: 2026-11-04
- Write-up quality: 8/10
- Original: https://www.reversinglabs.com/blog/binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit
- Library page: https://bugbountylibrary.com/r/blog%3Areversinglabs-com-blog-binance-heist-what-we-know-and-what-rl-sees-in-tradertraitors-toolkit
- Tags: area:cloud domain:infra impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:critical tech:ci-cd technique:recon technique:source-review vuln:auth-bypass vuln:secrets-leak

**Target:** Developer workstations and Terraform provider supply chain feeding wallet signing infrastructure
**Root cause:** A fraudulent recruiter lured an engineer into running terraform init on a repo whose .terraform.lock.hcl pinned a lookalike registry serving a trojanized Terraform AWS provider; the provider compiled in a malicious package that ran on plugin load.
**Steps:**
1. Recruiter sends engineer a coding-assignment repo containing a weaponized `.terraform.lock.hcl` pointing at `registry[.]hashicorp-terraform[.]io`
2. Engineer runs `terraform init`, pulling `terraform-provider-awsbeta_v1.0.0` (SHA-1 8473f85bda00dfa3...)
3. Provider writes run-once marker `session.lock`, downloads Bash loader `safari_updater` from `diagnose[.]hashicorp-terraform[.]io`, runs it detached, then behaves normally
4. Loader fetches a `.woff` container, splits at `@@ENDFONT@@`, Base64-decodes and AES-256-CBC decrypts with hardcoded passphrase `PTa3WZPQZAjj55t@`
5. Payload written to `~/Library/com.apple.iTunesCloud/SystemUpdate`, quarantine stripped via `xattr`, ad-hoc signed with `codesign -s -`, launched with `--type=renderer`
6. FLATROOF steals browser cookies, logins, keychain and shell history, then installs ROOFDECK backdoor
7. Stolen credentials and a container deployment token used to reach wallet signing infrastructure and submit unauthorized transactions
**How found:** ReversingLabs pivoted on published IOCs in Spectra Intelligence, ran RHA similarity to cluster the trojanized provider among 16 goodware builds, read the loader script to recover the AES key and decrypt the font container, and used submission-history/TLSH pivots to surface earlier ROOFDECK builds.
**Exploitation:** Attackers used the compromised workstation and an internal AI tool to pivot to two more engineering systems, harvesting credentials and a container deployment token. With those they reached Binance's wallet signing infrastructure and initiated unauthorized transfers. On-chain, a Tornado Cash-funded operator wallet deployed and rehearsed a sweeper contract; a single Ethereum type-4 transaction carried 50 EIP-7702 authorizations signed by hot wallet 'Binance 14' across consecutive nonces, delegating it to the sweeper, and one sweep() moved ~167,464 ETH, 1.615B USDT and 62 other tokens; XRP and other chains followed via ordinary signed transfers.
**Escalation:** Workstation compromise chained into lateral movement to additional engineering systems, then abuse of the signing path to mass-delegate a hot wallet and sweep funds across ten chains; ~$3B was frozen by Tether and Circle.
**Insight:** A weaponized `.terraform.lock.hcl` pinning a non-HashiCorp registry is a stronger signal than any reputation score, since lookalike registries score 0/49; and a WOFF file with an `@@ENDFONT@@` marker followed by a Base64 blob starting `U2FsdGVkX1` is a staged payload, not a font.

## Proof of concept (copied exactly from the original report)

**YARA rule for FLATROOF font container**

```
rule RL_TraderTraitor_FlatroofFontContainer_2026 {
 meta:
 description = "WOFF file carrying an appended @@ENDFONT@@ marker and Base64 payload, as used to stage FLATROOF"
 author = "[RL researcher], ReversingLabs"
 date = "2026-10-31"
 reference = "https://www.reversinglabs.com/blog/[post-slug]"
 hash = "62e988e9affcd000657bef4db47eb2e85c9a4cc42f4832780a02e19624e36e38"
 score = 85
 strings:
 // Delimiter between decoy font data and the encrypted payload
 $marker = "@@ENDFONT@@" ascii
 // Base64 run that follows the marker (long, no whitespace)
 $b64 = /@@ENDFONT@@[A-Za-z0-9+\/]{512}/ ascii
 condition:
 uint32be(0) == 0x774F4646 // "wOFF"
 and filesize < 20MB
 and $marker and $b64
}
```

**Loader decryption command with hardcoded passphrase**

```
Decryption is grep -a -b -o for the marker, then openssl enc -d -aes-256-cbc -md md5 -base64 -A with the hardcoded passphrase PTa3WZPQZAjj55t@. That is OpenSSL's legacy EVP_BytesToKey derivation with MD5, so the Base64 blob in every container built this way starts with U2FsdGVkX1, the encoding of Salted__. The key is in the script. Nothing else is needed to decrypt a container.
```