TraderTraitor, the cyber group linked to North Korean intelligence, is accused by the FBI of one of the largest digital heists in history. Cryptocurrency exchanges and companies are in the crosshairs: the stolen money would fuel Pyongyang’s missile programs.
THE’FBI attributed to the North Korean group TraderTraitor the gigantic cyber attack against Binancethe world’s largest cryptocurrency exchange platform. The theft, quantified at 6.3 billion dollars, represents an operation unprecedented in size. Binance said it had already covered 95% of its losses using its own resources and had restored withdrawals on Sunday. Behind this incursion lies an organization that in recent years has accumulated a criminal fortune of impressive dimensions, targeting exchanges, technology companies and private investors. TraderTraitor does not have an identifiable headquarters, website or known spokespeople. It is the name used by US authorities to indicate a group of North Korean hackers specialized in the theft of cryptocurrencies. Cybersecurity companies identify it with different names: Microsoft uses Jade Sleet, Mandiantcontrolled by Google, UNC4899While Palo Alto Networks talks about Slow Pisces. FBI, Japanese police And US Department of Defense use these identifiers to describe the activities of the same organization. The formation belongs to the larger network known as the Lazarus Group, a set of IT units linked to the Pyongyang regime. According to Western assessments, many of these structures depend on the Reconnaissance General BureauNorth Korea’s military intelligence. In the first official communications, Washington had associated TraderTraitor also to names Lazarus, APT38, BlueNoroff And Stardust Chollima.
A source of funding for the regime
Unlike state cyber groups primarily engaged in espionage, TraderTraitor has as its priority objective the acquisition of financial resources. There North Koreasubjected to severe international sanctions and isolated from a large part of the global banking system, has found in digital currencies a tool to obtain money outside of traditional circuits. United States, Japan And South Korea they declared that countering these thefts means preventing Pyongyang from financing its missile programs and weapons of mass destruction. Even second Chainalysisa company specialized in the analysis of blockchain transactions, the stolen cryptocurrencies are intended to support the strategic objectives of the regime. The name TraderTraitor appeared publicly in April 2022, when FBI, Cybersecurity and Infrastructure Security Agency (CISA) e US Department of the Treasury they issued a joint alert. The document reconstructed activities that began at least in 2020 against companies operating in the sector blockchain. Exchange platforms, decentralized finance projects, play-to-earn video games, specialized investment funds and people who owned significant amounts of cryptocurrencies were targeted. Among the tools used were trading applications that appeared reliable but contained malicious programs. One of the most used techniques is social engineering. Hackers build fake profiles, pose as recruiters on LinkedIn and approach company employees with job offers. They then send technical exercises and screening tests that hide malicious code. The system was used in 2024 against DMM BitcoinJapanese exchange. A member of the group, posing as a recruiter, contacted an employee of Ginco, a company that develops software for cryptocurrency wallets. A script was sent to the victim Pythonpresented as preliminary evidence for an application. Approximately two months later, the attackers used the access they gained to alter a transfer request legitimately crafted by an employee of the exchange. 4,502.9 bitcoins were stolen, equivalent to approximately $308 million. The FBI has highlighted that hackers often try to compromise multiple employees of the same organization, increasing their chances of penetrating infrastructure. Another mode of operation involves supply chain attacks. Instead of entering the target’s systems directly, attackers breach those of a trusted IT vendor and then use that access to reach customers. In 2023 Mandiant attributed to UNC4899 an intrusion to the detriment of JumpClouda company specializing in digital identity management. The company could have represented an entry point to numerous operators in the cryptocurrency sector.
The billions stolen in four years
The data of Chainalysis show the growth of North Korean operations. In 2023, approximately $660 million was stolen. In 2024 the loot reached 1.34 billion through 47 attacks, equal to 61% of all cryptocurrencies stolen in the world. In 2025 the value rose to at least 2.02 billion, especially as a result of the raid against Bybit. North Korean hackers were responsible for 76% of the total value stolen through attacks on cryptocurrency companies. At the end of the same year, Chainalysis estimated the total accumulated by North Korean organizations to be at least 6.75 billion dollars. A particularly relevant aspect concerns the change in strategy: the attacks have decreased in number, but the sums stolen have increased. The group seems to have abandoned indiscriminate raids to focus on objectives capable of guaranteeing much higher profits. The techniques include the infiltration of North Korean IT companies into companies in the sector and the impersonation of executives. After each operation, the money is transferred through a recycling process that can last around 45 days and involves exchanges, bridges between different blockchains and mixing services, used to make the origin of the resources less traceable. The sequence of attacks allows us to understand how this activity developed. In March 2022 the bridge Roninused by the video game Axie Infinity. The theft amounted to approximately $620 million and the FBI pointed to Lazarus as responsible. The following June the bridge was hit Horizon by Harmonyfrom which another 100 million disappeared. In 2023 the targets expanded to digital wallets and gambling platforms. Atomic Wallet recorded a loss of approximately 100 million dollars, while Stake.com suffered a 41 million attack. Both incidents were attributed by the American authorities to North Korea. 2024 marked a further escalation. Besides the case DMM Bitcoin, United States And South Korea they attributed to Pyongyang the theft of $235 million from the Indian exchange WazirX and 50 million from Radiant Capital. Washington, Tokyo and Seoul also pointed to North Korean hackers as responsible for the theft of $50 million from the South Korean platform Upbit. In February 2025 the most sensational blow arrived: from Bybit Approximately 401,000 Ether tokens were stolen, worth close to $1.5 billion. The hackers had compromised the computer of a developer of Safe, the company that provided the exchange with the interface for managing wallets. Through the insertion of malicious code they managed to modify the authorization operations. What appeared to be a normal transfer turned into sending resources towards the attackers. The FBI attributed the operation to TraderTraitor just five days later. The attack on Binance it represents a further leap in scale and concentrates the techniques refined by the group over the years: manipulation of employees, clandestine access, alteration of transaction signing procedures and money laundering through digital circuits that are difficult to control. The previous record of Bybitapproximately $1.5 billion, was surpassed by more than four times. Binance assures that customers will not suffer losses, but for theFBI the movement and laundering of the stolen funds is still ongoing.
