TraderTraitor: North Korea's Crypto Theft Unit Explained

TraderTraitor is the label the FBI, CISA and the US Treasury use for a North Korean state-sponsored group that steals cryptocurrency. The FBI attributed the Bybit theft of about $1.5 billion in February 2025 to it. According to reporting on an FBI alert published on 31 October 2026, the FBI also attributes the Binance theft of more than $6 billion to North Korea and links it to TraderTraitor. It is the most consequential crypto-theft actor on record, and what it does to its victims follows a pattern a defender can plan against.

Who this is for: security leaders, engineers and compliance staff at exchanges, custodians, wallet providers, DeFi projects and any company that holds or moves digital assets.

Compiled on 2 November 2026 from government advisories, vendor research, on-chain analytics firms and the victims' own statements, all listed under Sources. Where we read a document through press coverage rather than the original, the text says so. Reporting on the Binance incident is still developing. PlayCISO is not affiliated with any company named here.

Who TraderTraitor is, in plain words

TraderTraitor is a government-assigned name for a pattern of activity, first set out in the joint FBI, CISA and Treasury advisory AA22-108A of 18 April 2022. That advisory describes a North Korean state-sponsored actor active since at least 2020 that targets organisations in the blockchain and cryptocurrency industry: exchanges, DeFi protocols, play-to-earn games, trading companies, venture funds and individuals holding large amounts of crypto or NFTs. Its goal is money. Unit 42 describes the cluster it tracks as Slow Pisces as focused on "generating revenue for the DPRK regime", and says the campaign it studied went after fewer, higher-value targets than other groups operating out of North Korea.

It is not the whole of North Korean cyber activity. Lazarus Group is a much broader umbrella label, and North Korea runs separate espionage and IT-worker operations. This post covers only the crypto-theft specialist.

Names and aliases: who calls it what

Every vendor builds its own cluster from its own telemetry, so the names below overlap rather than map one to one. The APT Rosetta Stone (Pro, free to try) is the place to check a name you meet in a report.

Two cautions. First, BleepingComputer's report on the FBI's Binance alert says the group is also tracked as Lazarus Group, Jade Sleet and APT38; Help Net Security's report on the same alert lists no other names. We could not open the alert itself, so we do not say which aliases the FBI wrote. Second, the FBI's April 2022 Ronin attribution used the labels Lazarus Group and APT38, not TraderTraitor, as reported. Google's report counts that theft among the activity of UNC4899, which is the kind of cross-vendor mapping you should treat as a vendor judgement.

What it targets and why

• Exchanges and their wallet infrastructure. Hot wallets and the systems that sign withdrawals hold the most value in the least time. Bybit and Binance are the two largest examples.
• Wallet and custody software providers. In the DMM Bitcoin case the entry point was an employee of Ginco, a wallet software company that handled DMM's wallet management. In the Bybit case it was Safe{Wallet}, the multisig interface Bybit's signers used. Attacking the supplier reaches many customers through one door.
• Developers and DevOps staff. AA22-108A says intrusions target employees of crypto companies, often in system administration or DevOps roles. GitHub reported that the campaign it saw targeted personal accounts of technology employees, many in blockchain, cryptocurrency or online gambling.
• Cloud accounts that host crypto front ends. Google's report describes two cloud intrusions that ended in the replacement of JavaScript files with code meant to manipulate crypto functions and trigger transactions from a target's wallet, with withdrawals of "several million" dollars.
• Executives and investors. Chainalysis's 2025 report adds that the broader North Korean ecosystem poses as strategic investors or acquirers, and places IT workers inside crypto firms. Those are not TraderTraitor-specific findings, but they sit in the same threat model.

Dated incident timeline

Amounts are as stated by the named source on the named date. Where sources differ, both are shown. The row for each incident says who attributes it to this actor.

For the first days of the Binance event, including the Aave loan that let the attacker turn frozen-able USDT into ether, see our Binance hack write-up.

How the group operates, for defenders

The techniques below come from the cited reports. The ATT&CK identifiers are our mapping for detection planning, not identifiers assigned by those vendors. This is a description of what to look for, not a how-to.

1. The way in is a person, usually a developer

• Fake recruiters and collaborators (T1566.003, spearphishing via service). GitHub describes fake developer and recruiter personas on GitHub, LinkedIn, Slack and Telegram, some of them taken-over genuine accounts, that move a target between platforms. Unit 42 describes recruiters sending a benign job description PDF, then a question sheet with a "real project" challenge linked to a repository. The FBI and DC3 statement on DMM describes the same recruiter-and-coding-test pattern against the Ginco employee.
• Code the target is asked to run (T1204, user execution; T1195.001, compromise of software dependencies and development tools). GitHub reports repositories whose npm dependencies download a second stage; Unit 42 reports repositories adapted from real open-source apps that fetch content from an attacker-controlled look-alike domain and deliver a payload only to targets the server judges valid. Google reports victims being persuaded to run a malicious container on a workstation. AA22-108A describes trojanised crypto "trading" applications as the 2022 form of the same lure.
• Targeting personal accounts. GitHub's alert is explicit that the campaign hit personal accounts. Unit 42's main recommendation is strict separation of corporate and personal devices, because a lure that lands on a personal laptop can still hold work credentials.

2. From the workstation to cloud and signing infrastructure

• Stolen cloud credentials and session tokens (T1552.001, T1539, T1550.001, T1078.004). In the Safe{Wallet} case, as reported by Elastic, the attackers used the developer's access key and a temporary session credential that was valid for about 12 hours. Google reports a Google Cloud intrusion run through the command-line tool over an anonymous VPN, and an AWS intrusion that used long-term keys from a credential file, with likely session cookie theft.
• Tampering with multi-factor authentication (T1556.006, T1098.005). Safe's attempt to enforce re-authentication every 12 hours prompted the attackers to try registering their own MFA device, which failed, per Elastic. In one Google case the actors found the account had administrative privileges, disabled MFA, then re-enabled it afterwards, per The Hacker News. The lesson is that MFA protects the login, not the session that follows, and not an administrator who can switch it off.
• Altering the code that users and signers trust (T1565.002, transmitted data manipulation). At Safe the front-end JavaScript was changed so that it would only act on transactions for Bybit's cold wallet. At the two cloud victims in Google's report, the replacement scripts were designed to manipulate crypto functions and trigger transactions from the victim's wallet. The people approving see a normal screen; what is signed is different.

3. Binance: signing infrastructure, not a leaked key

Binance says it found no evidence of a wallet private-key leak, that a compromised DevOps engineer's laptop led to a service container used to submit withdrawals, and that more points of breach exist. On the chain, Hypernative, Chainalysis and TRM describe a hot wallet on Ethereum being delegated with an EIP-7702 authorisation to attacker code, then swept, while wallets on the other chains sent ordinary signed transfers. TRM's assessment is that the most likely cause is a compromise of Binance's hot wallet signing infrastructure rather than phishing, because phishing would not explain the other chains. TRM also notes small Tornado Cash withdrawals funding an operator wallet, staging well ahead of the theft and signatures executed in one burst as features shared with earlier North Korea-linked thefts. None of that is a public root cause. Binance has said it will publish more.

4. Cashing out

• Speed first. Chainalysis and TRM both record large movements within minutes. Chainalysis reports $325 million of stablecoins swapped for $285 million of ETH over nearly 20 minutes after Binance, moving value out of freezable tokens. TRM reports roughly 325 million USDT sold at a discount of more than 10 percent.
• Waves over about 45 days. Chainalysis's 2025 report describes layering through DeFi and mixers in days 0 to 5, limited-KYC and centralised exchanges around days 6 to 10, and a long tail through no-KYC exchanges, instant exchanges and Chinese-language laundering networks out to day 45, with some funds dormant for months or years. About 60 percent of North Korean laundering volume sat below $500,000 per transfer.
• Different routes per theft. After Bybit, reporting named THORChain and the eXch service as main non-custodial routes. TRM says the Binance laundering so far leans on large swaps through market makers and lending protocols, unlike the bridge-heavy Bybit pattern, and expects bridges, swap services and OTC brokers next. The FBI said it saw most assets converted into Ethereum.
• Freezing works when it is fast. TRM lists about $2.7 billion frozen by 30 October at 00:30 UTC, including USDT and USDC from Tether and Circle, RLUSD from Ripple, USD1 and 8,426 ETH frozen by the Arbitrum Security Council. TRM says the attacker still held more than 420,000 ETH and 18,270 BTC, about $2.4 billion. Tether's CEO put the USDT frozen at more than $1.567 billion in the statement we cite in our Binance post, while TRM lists about 1.77 billion USDT; the figures were still moving.

How much has been stolen? Read the totals carefully

Both totals are for North Korea as a whole, not for TraderTraitor alone, and they use different methods and cut-off dates, so they cannot be added or compared directly.

What a crypto exchange, custodian or platform should do

These are our recommendations, informed by the sources above. They are ordered by the attack chain, not by cost.

Signing and approval workflows

• Make signers verify what they sign, not what they see. The Bybit signers saw a normal-looking screen served by a compromised front end. Require an independent decode of the transaction (destination, amount, call data) on a separate trusted device or tool that does not share the front end, for every high-value approval.
• Tier by value and time. Keep the minimum online. Add delay and out-of-band confirmation above thresholds, and cap what any single path can move in a window.
• Separate signing paths by chain and wallet tier. TRM recommends it: a compromise on one chain's path should not authorise another's.
• Pre-approve a revocation path and test it. TRM recommends a tested, pre-approved method for signing revocations. Binance's delegation stayed active for almost four hours, per Hypernative, as covered in our earlier post.

Wallet infrastructure and monitoring

• Alert on unexpected EIP-7702 delegations on any Ethereum-compatible treasury wallet, reject authorisations you did not initiate, and treat requests for many authorisations across a range of nonces as a compromise indicator (TRM's recommendations).
• Screen against the FBI lists. The FBI published 51 Ethereum addresses after Bybit and 628 after Binance (608 Ethereum, 19 Bitcoin, 1 Solana), and asks exchanges, bridges, node operators, DeFi services and analytics firms to block transactions with them. Wire that list into deposit and withdrawal screening and refresh it.
• Know which assets can be frozen. Map which of your holdings an issuer can freeze, and who you would call in what order for each.

Developer workstations and the supply chain

• No untrusted code on machines that hold credentials. Give engineers a disposable, isolated environment for coding tests, unknown repositories and package trials, with no cloud keys, SSH keys or browser sessions. Unit 42's top recommendation is strict separation of corporate and personal devices.
• Treat container and package execution as code execution. Review dependencies and install scripts, restrict what a build or test can reach on the network, and alert on workstations that fetch from look-alike data domains. See GitHub supply chain controls.
• Short-lived, device-bound cloud credentials. Remove long-lived keys from credential files, shorten session life, bind sessions to managed devices, and alert on new MFA device registration, MFA being disabled, and administrator actions from anonymising networks. The phishing-resistant MFA planner can help sequence it.
• Protect what you serve. Control write access to the buckets and pipelines that deliver your wallet or admin front end, require signed deployments, and alert on any change to production JavaScript outside the pipeline.

Social-engineering and fake-job defences

• Tell engineers, finance and executives, in plain terms, that unsolicited recruiters, "freelance" offers and coding tests are the entry point GitHub, Unit 42, Google and the FBI each describe.
• Give staff a single report channel and thank them for using it. GitHub advises anyone who ran suspect content to contact their security team, and to consider wiping the device and rotating credentials stored on it.
• Extend the briefing to personal accounts and to executives approached as investors or acquirers.

Vendors and third parties

• Inventory suppliers whose compromise can change what your signers see or what your wallets do: wallet interfaces, key-management and custody software, cloud and CI providers. DMM Bitcoin and Bybit were both reached through a supplier.
• Ask them for the same controls you hold yourself, and for a notification commitment measured in hours.

Threat intelligence and incident readiness

• Staff for it. A crypto exchange, custodian or platform moving more than $1 million a day needs a threat intelligence function that follows TraderTraitor continuously, uses AI to process the volume of reporting, and maintains partnerships with specialised CTI and on-chain analytics firms, so that new infrastructure, lures and addresses reach your controls the same day. Otherwise the next incident report is about you. Our threat intel feed and APT Knowledge Graph are a starting point for the reading list, not a substitute for a dedicated service.
• Rehearse the first hour. Who contacts Tether, Circle and other exchanges, who revokes, who talks to the FBI, who writes the customer statement. Practise it with the IR Playbook Lab.
• Law-enforcement liaison. The FBI asks victims to report to a local field office or to ic3.gov. Establish the relationship before the incident, and keep a current contact for the issuers' compliance desks.

What to do this week

• Pull the 628-address FBI list and the 51-address Bybit list into transaction screening, and confirm screening alerts reach a person.
• Check that every Ethereum-compatible treasury wallet is monitored for EIP-7702 delegations and that you can revoke within minutes.
• Pick your five highest-value signing paths and confirm each has an independent transaction decode.
• Ask engineering which machines run take-home tests, unknown repositories or containers, and move them off devices that hold cloud keys.
• List long-lived cloud keys and credential files on workstations, and set a date to remove them.
• Add alerts for MFA device registration, MFA being disabled and production JavaScript changes outside the pipeline.
• Send a plain-language note to staff about recruiters and coding tests. Include executives and finance.
• Write down who calls whom in the first hour of a theft, including issuers and the FBI.
• Decide who owns continuous tracking of this actor, internally or through a CTI partner.
• Expect scam messages claiming to offer compensation or reopening after the Binance event, and warn customers through official channels only.

Frequently asked questions

What is TraderTraitor?

TraderTraitor is the name the FBI, CISA and the US Treasury use for a North Korean state-sponsored cluster that steals cryptocurrency from exchanges, custodians, wallet providers, DeFi projects and the people who work at them. The name was introduced in the joint advisory AA22-108A in April 2022, and the FBI has used it in its attributions of the DMM Bitcoin theft (December 2024), the Bybit theft (February 2025) and the Binance theft (31 October 2026).

Is TraderTraitor the same as Lazarus Group?

Not cleanly. Lazarus is an umbrella label that governments and vendors apply to many North Korean operations, and the 2022 advisory lists Lazarus Group, APT38, BlueNoroff and Stardust Chollima as other names for the activity it describes. Some vendors treat TraderTraitor as a crypto-theft sub-cluster inside that umbrella, and press coverage of the FBI's later alerts often describes it as Lazarus. Treat the mapping as overlapping rather than one-to-one. We cover the umbrella in our Lazarus Group profile.

Who was behind the Bybit hack?

The FBI attributed the roughly $1.5 billion theft from Bybit, which it dates to on or about 21 February 2025, to North Korea and said it refers to this activity as TraderTraitor (FBI PSA I-022625-PSA, 26 February 2025). Sygnia and Verichains traced the root cause to malicious code originating in Safe{Wallet}'s infrastructure, not to Bybit's own systems.

Did the FBI confirm North Korea was behind the Binance hack?

Yes. According to reporting by BleepingComputer and Help Net Security, an FBI alert published on 31 October 2026 said North Korea was responsible for the theft of more than $6 billion in virtual assets from Binance on or about 29 October and linked it to TraderTraitor. TRM Labs and Chainalysis had reached the same assessment the day before, on the basis of on-chain evidence. Binance had not, in what we have seen, named a group and said its investigation was continuing.

How much crypto has North Korea stolen?

It depends on who is counting and what is counted. Chainalysis put North Korean theft at at least $2.02 billion in 2025, about 59 percent of the more than $3.4 billion stolen industry-wide that year. TRM Labs put its total for North Korea-backed hackers at about $12.8 billion across about 100 incidents since 2017, through 29 October 2026, of which about $7.4 billion in 2026. These are totals for North Korea as a whole, not for TraderTraitor alone.

What is Jade Sleet?

Jade Sleet is Microsoft's name for a North Korean cluster. GitHub's July 2023 security alert says Microsoft calls the group Jade Sleet and CISA calls it TraderTraitor. Unit 42 lists Jade Sleet among the names for the activity it tracks as Slow Pisces.

What is UNC4899?

UNC4899 is Google and Mandiant's designation. The Hacker News, summarising Google Cloud's Cloud Threat Horizons report for the second half of 2025, says UNC4899 overlaps with Jade Sleet, PUKCHONG, Slow Pisces and TraderTraitor. Overlap is not identity: each vendor builds its cluster from its own telemetry.

How do fake recruiters target crypto developers?

GitHub, Unit 42 and the FBI describe the same pattern. A person posing as a recruiter or fellow developer approaches an engineer on LinkedIn, Telegram or a similar platform, then sends a take-home coding task or a repository to run. The code looks legitimate but pulls in something malicious. The defensive point is that the target is a person with access, and the exposure is whatever that person's machine can reach: source code, cloud keys, session tokens and signing tools.

How do exchanges protect against TraderTraitor?

There is no single control. The pattern across the incidents is a developer or operator workstation, then cloud or signing infrastructure, then a transaction that looks normal to the people approving it. Controls that address that chain: separate machines and accounts for untrusted code, short-lived and device-bound cloud credentials, independent verification of what a signer is really approving, monitoring for unexpected wallet delegations, pre-agreed freeze and law-enforcement contacts, and a threat intelligence function that tracks this actor continuously.

How does North Korea launder stolen crypto?

Chainalysis describes a multi-wave pattern over roughly 45 days across major North Korean thefts from 2022 to 2025: fast layering through DeFi and mixers in the first days, then limited-KYC and centralised exchanges, then a long tail through no-KYC exchanges, instant exchanges and Chinese-language laundering networks. After Binance, the FBI said it saw the group convert most assets into Ethereum and expected further laundering through DeFi platforms and instant swap services.

Can stolen crypto be frozen?

Issuer-controlled tokens such as USDT and USDC can be frozen by Tether and Circle, and chain governance bodies sometimes act: TRM reported about $2.7 billion frozen by 30 October 2026 after the Binance theft, including a freeze of 8,426 ETH by the Arbitrum Security Council. Native assets such as ETH and BTC cannot be frozen by an issuer, which is why speed of contact with issuers and exchanges matters.

Related profiles and tools

Read the broader umbrella in our Lazarus Group profile. For the Binance incident in detail, see how the attacker dodged the USDT freeze. To translate vendor names, use the APT Rosetta Stone; to see connections between actors, origins and sectors, use the APT Knowledge Graph. Both are Pro (free to try with a free account).

Sources

Government and primary documents first.

• FBI IC3 PSA I-022625-PSA: North Korea responsible for $1.5 billion Bybit hack (26 Feb 2025)
• CISA, FBI and Treasury advisory AA22-108A: TraderTraitor (18 Apr 2022)
• FBI alert on the Binance theft (31 Oct 2026), read through BleepingComputer and Help Net Security; we could not open the alert itself
• FBI, DC3 and NPA statement on the DMM Bitcoin theft (23 Dec 2024), read through BleepingComputer and Cointelegraph
• GitHub: security alert, social engineering campaign targets technology industry employees (18 Jul 2023)
• Palo Alto Networks Unit 42: Slow Pisces (14 Apr 2025)
• The Hacker News, summarising Google Cloud Threat Horizons H2 2025 on UNC4899 (31 Jul 2025); we could not open the Google report directly
• Elastic Security Labs: Bit ByBit, summarising Safe, Mandiant, Sygnia and SlowMist findings
• The Hacker News: Bybit hack traced to Safe{Wallet} supply chain (Sygnia, Verichains, Silent Push)
• Cointelegraph: Safe{Wallet} releases Bybit post-mortem
• Chainalysis: Binance hack, tracing the $6.4 billion theft to North Korea (30 Oct 2026)
• Chainalysis: 2025 crypto theft reaches $3.4 billion (Dec 2025)
• TRM Labs: North Korea steals USD 6.36 billion from Binance (30 Oct 2026)
• TRM Labs: North Korea has stolen USD 12.8 billion in crypto (30 Oct 2026)
• The Hacker News: Bitget says suspected North Korean actors stole crypto (Sep 2026), citing Bitget, TRM and Elliptic
• BleepingComputer: Binance links $6.3 billion theft to a compromised DevOps laptop
• BleepingComputer: FBI links Ronin theft to Lazarus (Apr 2022)