TraderTraitor

A joint advisory by the FBI, CISA and the U.S. Treasury records activity observed since at least 2020 against cryptocurrency exchanges, DeFi protocols, play-to-earn game companies, cryptocurrency trading firms, crypto-focused venture capital funds and individuals holding large amounts of cryptocurrency or valuable NFTs; employees in system administration and DevOps roles were frequent targets. The actors sent large numbers of spearphishing messages over several communication platforms, often disguised as recruitment for high-paying jobs, to persuade victims to download trojanized cryptocurrency applications on Windows or macOS.⁠[1]

The applications were written with JavaScript, Node.js and the Electron framework and derived from open-source projects. They included DAFOM, posing as a cryptocurrency portfolio application; TokenAIS and CryptAIS, advertised as AI-based trading tools; AlticGO, distributed as Windows NSIS executables; Esilet, which claimed to offer live prices and predictions; and CreAI Deck, which claimed to be an AI and deep-learning platform. An “update” function in the applications downloaded and ran a malicious payload; the advisory identifies it as Manuscrypt, a remote access trojan for Windows and macOS that collects system information, runs arbitrary commands and downloads further payloads. Post-compromise activity was tailored to each victim and sometimes began within a week of the initial intrusion.⁠[1]

On April 18, 2022, the FBI, CISA and the U.S. Treasury published joint cybersecurity advisory AA22-108A, “TraderTraitor: North Korean State-Sponsored APT Targets Blockchain Companies.” The advisory said the U.S. government had observed North Korean state-sponsored actors using tactics similar to those of Lazarus GroupLazarus GroupLazarus Group is a name used by cybersecurity researchers and governments for North Korean state-sponsored cyber operations involving espionage, destructive attacks and financial theft. Definitions and subgroup boundaries vary between sources. The U.S. Treasury attributes the group to North Korea’s Reconnaissance General Bureau and sanctioned it in 2019.Open the full entry, a cluster tracked in industry under names including Lazarus Group, APT38, BlueNoroff and Stardust Chollima; TraderTraitor was the government’s name for the series of malicious applications. It also likened the tactics to AppleJeus, the trojanized cryptocurrency applications of Lazarus Group described in an earlier advisory.⁠[1]

On July 18, 2023, GitHub’s chief information security officer, Alexis Wales, disclosed a low-volume social-engineering campaign against the personal accounts of technology-company employees and assessed with high confidence that it was run by a group supporting North Korean objectives, the one CISA calls TraderTraitor. Posing as developers or recruiters through fake or taken-over accounts on GitHub, LinkedInLinkedInLinkedIn is a social networking platform for professionals. It was founded in 2002 by Reid Hoffman and others, launched in 2003, and listed on the New York Stock Exchange in 2011; after Microsoft acquired it for approximately $26.2 billion in 2016, it became a wholly owned Microsoft subsidiary. Its revenue comes from membership subscriptions, advertising, and recruitment solutions.Open the full entry, Slack and Telegram, the actor invited targets to collaborate on GitHub repositories and run their contents; malicious npm dependencies in the repositories served as first-stage malware that downloaded second-stage malware. Most targets were connected to blockchain, cryptocurrency or online gambling, and a few to cybersecurity. GitHub said none of its or npm’s systems were compromised, suspended the accounts involved and published indicators of compromise.⁠[2]

On July 24, 2023, Mandiant published its analysis of a supply-chain attack on JumpCloud: the intrusion began with spear-phishing against the directory-platform provider, and the attackers inserted malicious code into its commands framework; on June 27 a malicious Ruby script ran through the JumpCloud agent at a downstream customer and downloaded further payloads. JumpCloud said fewer than five customers and fewer than 10 devices were affected. Mandiant tracked the actor as UNC4899, assessed with high confidence that it is a cryptocurrency-focused element of North Korea’s Reconnaissance General Bureau, and said that, based on reporting from trusted partners, UNC4899 likely corresponds to the TraderTraitor activity in the CISA advisory.⁠[3]

In December 2024, the FBI attributed the May theft from the Japanese cryptocurrency exchange DMM Bitcoin to North Korean state-affiliated cyber actors it tracks as TraderTraitor, listing aliases including Jade Sleet, UNC4899 and Slow Pisces. As the FBI described it, from late March 2024 an attacker posing as a recruiter on LinkedIn approached an employee of Ginco, a Japanese cryptocurrency wallet software company, and sent a GitHub project presented as a pre-employment test that contained malicious Python code, compromising the employee’s computer; after mid-May the attackers used session cookies to impersonate the employee and access Ginco’s communications; and in late May they likely manipulated a legitimate DMM transaction request, causing the loss of 4,502.9 BTCBitcoinBitcoin (common symbol BTC) is an open peer-to-peer electronic cash protocol, network, and native digital asset. Full nodes independently verify transactions and blocks according to the consensus rules; transactions are recorded as UTXOs, and blocks are organized into a public ledger through proof of work. Bitcoin is not issued or managed by any single institution, but using, holding in custody, and trading it still involve key, privacy, market, and legal risks.Open the full entry, worth about $308 million at the time.⁠[4]

The FBI made the attribution together with U.S. and Japanese investigators.⁠[5]

On February 26, 2025, the FBI issued a public service announcement saying North Korea was responsible for stealing about $1.5 billion in virtual assets from Bybit on or around February 21, 2025, and referring to the activity as TraderTraitor. It said the actors had quickly converted some of the assets to bitcoin and other assets, dispersed across thousands of addresses on multiple blockchains, and were expected to launder them further and eventually convert them to fiat currency. The FBI asked RPC node operators, exchanges, bridges, blockchain analytics firms and DeFi services to block transactions with the addresses involved and published 51 EthereumEthereumEthereum is an open, general-purpose smart contract blockchain that launched in 2015, and its native asset is ether (ETH). The project was proposed by Vitalik Buterin and advanced jointly by eight co-founders; the network now uses proof of stake and centers on the EVM, the account model, a rollup scaling roadmap, and the open EIP process.Open the full entry addresses.⁠[6]

On April 14, 2025, Palo Alto NetworksPalo Alto NetworksPalo Alto Networks is an American cybersecurity company that offers network security, cloud security, security operations, identity security, and artificial intelligence security products, and provides threat intelligence, assessment, and incident response services through Unit 42.Open the full entry’ Unit 42 said that Slow Pisces, a North Korean state-sponsored group, mainly generates revenue for the North Korean regime, usually by targeting large cryptocurrency organizations. Posing as recruiters on LinkedIn, the group approached cryptocurrency developers, sent benign PDF job descriptions and then directed targets to GitHub projects disguised as coding challenges, mostly in Python and JavaScript; only validated victims received malicious payloads. The report disclosed two new Python malware families: RN Loader, a loader that runs mostly in memory, and RN Stealer, which steals the macOS keychain, SSH keys and AWS, Kubernetes and Google Cloud configuration files.⁠[7]

At 18:31 UTC on September 24, 2026, Bitget’s security systems flagged unauthorized transfers; the loss from hot and warm wallets was first put at $351.6 million and later updated to about $390.06 million. Bitget described the attackers as “suspected North Korean threat actors,” and chief executive Gracy ChenGracy ChenGracy Chen is a business executive, investor, and digital asset industry professional who has served as chief executive officer of Bitget since May 2024. She studied applied mathematics, hosted finance and technology programs, began learning about and investing in crypto assets in 2015, and later took part in fintech and virtual reality startups; in June 2022 she joined Bitget as its first managing director, responsible for global growth, strategy, business, and corporate development. She holds a bachelor’s degree from the National University of Singapore and an MBA from the Massachusetts Institute of Technology.Open the full entry said the method was “highly consistent with known patterns of North Korean hacker organizations.” TRM Labs found wallet overlaps with earlier North Korean hacks including Bybit and said they pointed to TraderTraitor, and Elliptic linked the stolen funds to addresses used to launder the Bybit proceeds.⁠[8]

TRM Labs said that on October 29, 2026, an attacker moved about $6.36 billion out of Binance wallets on ten blockchains, most of it within about 20 minutes starting at 20:05 UTC, making it the largest crypto theft on record and about four times the Bybit theft; Binance estimated the impact at about $6.3 billion. Binance’s preliminary investigation found that the intrusion began with a DevOps engineer’s compromised laptop, after which the attacker accessed a service container and submitted unauthorized withdrawal transactions; it had found no evidence of a wallet private-key leak.⁠[9]

TRM Labs attributed the attack to TraderTraitor “with high confidence” in a post on October 29. Chainalysis chief executive Jonathan Levin wrote: “We assess Binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.” ZachXBTZachXBTZachXBT is a pseudonymous blockchain investigator who examines cryptocurrency scams, thefts and fund movements, and serves as an incident response advisor to Paradigm. His work involves public investigations, onchain analysis and collaboration with security researchers and law enforcement.Open the full entry said funds stolen from Binance and Bitget had been commingled at the same address after moving through THORChain: “This indicates the same actor is likely behind both incidents.”⁠[10][5]

Tether, Circle, Ripple and World Liberty FinancialWorld Liberty FinancialWorld Liberty Financial is a crypto finance venture launched in September 2024, co-founded by members of the families of US President Donald Trump and Steve Witkoff, among others; it issues the governance token WLFI and offers the US dollar stablecoin USD1 as its main product. Over the Trump family’s large income from token sales, foreign investors taking stakes, and regulatory approvals, it has faced ongoing conflict-of-interest questions from members of the US Congress and ethics watchdogs; the company and the White House have denied any wrongdoing.Open the full entry froze about $2.67 billion in stablecoins, and the Arbitrum Security Council froze 8,426 ETH and 74.6 million ARB on its network. TRM Labs said the attacker “raced the freezes” by selling USDT to market makers and borrowing ETH against USDT on AaveAaveAave is a decentralized, non-custodial lending protocol deployed on Ethereum and several other public blockchains, where users can deposit crypto assets into liquidity pools to earn interest or borrow on an overcollateralized basis. The protocol is governed by the Aave DAO, made up of AAVE token holders.Open the full entry, and still held more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion and beyond any issuer’s reach.⁠[9]

On October 30, the FBI said only that “The FBI is aware of the incident and is engaged with relevant public and private partners,” and did not attribute the intrusion to North Korea at that point.⁠[11]

On Saturday, October 31, the FBI said North Korea was responsible for the Binance security incident, stating that it, along with the U.S. Secret Service and the IRS, had observed North Korean malicious cyber activity it refers to as TraderTraitor. It said the stolen assets were being converted primarily to ether and that “It is expected these assets will then be further laundered by converting them using DeFi and instant swap services.”⁠[12]

The FBI asked cryptocurrency exchanges and blockchain analytics firms to block transactions linked to a number of addresses and noted that TraderTraitor was also behind the $1.5 billion Bybit theft in 2025.⁠[13][10]

Asked about the theft at a Halloween party at Mar-a-Lago on the night of Saturday, October 31, Donald Trump said he was not concerned, that “we’re learning about it,” and that “We don’t know if it’s North Korea - but if it is, we’ll talk to North Korea about it.”⁠[13][14]

Different organizations use different names for the cluster: Microsoft Threat Intelligence calls it Jade Sleet, GoogleGoogleGoogle is an American technology company founded by Larry Page and Sergey Brin and incorporated in 1998. It became an Alphabet subsidiary in 2015. Its businesses include internet search, advertising, software platforms, cloud computing, and artificial intelligence.Open the full entry’s Mandiant tracks it as UNC4899, and Palo Alto Networks’ Unit 42 calls it Slow Pisces, listing Jade Sleet, TraderTraitor and PUKCHONG among its aliases.⁠[2][3][7]

The U.S. Treasury says TraderTraitor members are believed to be part of the wider Lazarus Group.⁠[10]