727 FinanceFrom the $6.3 billion Binance theft to major cryptocurrency industry heists such as Bybit and Ronin, the North Korean hacker group TraderTraitor has gradually come to light. How has this hacker network, designated by the U.S. government, used fake recruitment, supply chain attacks, and signature hijacking to make off with nearly $10 billion in crypto assets?
Author: BlockBeats
On November 1, the U.S. Federal Bureau of Investigation issued a notice attributing the $6.3 billion stolen from Binance on October 29 to North Korea. The notice used one term: TraderTraitor.
If you search this name, you will find that Bybit's $1.5 billion, Bitget's $300 million, and several major cryptocurrency cases from previous years are all connected to this name.
TraderTraitor is not a company, nor a box on an organizational chart. It is a codename the U.S. government has given to a category of behavior.
In April 2022, the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Department of the Treasury jointly issued a notice numbered AA22-108A. That was the first formal appearance of the term. At the time, it referred to several trojans disguised as crypto trading software, such as DAFOM, TokenAIS, and CryptAIS, whose interfaces looked convincing and which began stealing private keys once installed.
The people behind this have long been called Lazarus Group, APT38, BlueNoroff, and Stardust Chollima in the industry. These are not four separate teams. Lazarus is the umbrella name; APT38 (Mandiant), BlueNoroff (Kaspersky), and Stardust Chollima (CrowdStrike) are three names given by different security companies to the same money-making line.
Two years later, the label was attached to specific conduct. On December 23, 2024, the FBI, the U.S. Department of Defense Cyber Crime Center, and the Japanese National Police Agency jointly released an attribution for the $300 million DMM theft case, using for the first time the phrasing "North Korean cyber actors tracked as TraderTraitor" and listing its three aliases: Jade Sleet (Microsoft's name), UNC4899 (Google's name), and Slow Pisces (Palo Alto's name).
The information is now relatively clear: TraderTraitor is the unit within the larger Lazarus group that specializes in crypto assets and is currently the most lucrative. At least since 2020, it has focused exclusively on the blockchain—trading platforms, DeFi, wallet service providers, crypto funds, and individuals holding large amounts of coins.
From robbing banks to robbing trading platforms
Lazarus is an umbrella name that covers everything, from wiping Sony Pictures' hard drives in 2014 to moving money out of Bangladesh Bank in 2016.
Take the Bangladesh Bank case. The unit that carried it out was then called APT38, also known as BlueNoroff. In February 2016, they forged SWIFT instructions (the international messaging system used for interbank transfers) and tried to transfer $1 billion out of Bangladesh Bank's account at the New York Fed. They ultimately got $81 million, because a spelling error in one transfer caused an intermediary bank to stop it.
The craft of studying banks' operating procedures, finding gaps in manual review, and forging instructions was later transplanted unchanged to cryptocurrency trading platforms.
Around 2020. They began upgrading their methods, with the crypto world as the target. The reason is easy to guess: there is money and no regulation, and liquidity is decent.
There are several methods of attack.
The first is fake recruiting. A headhunter contacts you on LinkedIn, has a pleasant conversation, and finally sends an "pre-employment programming test" or an installer for an "internal tool." Once installed, the machine belongs to them. Ronin's $620 million was lost this way.
The second is the supply chain. Instead of deceiving people, they shift to contaminating developers' toolchains: malicious repositories on GitHub, poisoned packages on npm, identity service providers such as JumpCloud. One person is compromised, and a string of downstream companies is compromised as well.
The third is directly altering transactions. In the Japanese DMM case, they stole the other side's login credentials, infiltrated the internal communications of the wallet company Ginco, and then altered a transfer that should have been normal. In the Bybit case, they hacked into a developer's computer at Safe{Wallet} and inserted a script into the web front end; the signers still saw a normal page, but what they signed was another transaction.
This also includes the Binance case this time.
The attackers prepared 36 hours in advance, signed 50 EIP-7702 authorizations—a new Ethereum feature that allows a wallet to temporarily "rent" a program for use—and then made Binance's hot wallet transfer the money out itself; 40 minutes, across 10 networks. The conclusion of one security firm is that they very likely had already reached Binance's signing system.
The amount involved in this organization's cases
The twelve most famous cases: $9.7 billion.
Binance alone accounts for $6.3 billion. The remaining eleven cases, from 2022 to 2026, add up to $3.44 billion.
Bybit's $1.5 billion was the altered front end; Ronin's $620 million was the recruiting scam; Bitget's $388 million was forged withdrawal instructions written into the wallet system.
DMM $308 million, WazirX $235 million, Harmony and Atomic $100 million each, Alphapo $60 million, CoinEx $55 million, Stake $41 million, CoinsPaid $37 million.
In the chart, only the Binance, Bybit, and DMM cases were directly named by the U.S. government as TraderTraitor. Ronin, Harmony, Stake, Alphapo, CoinsPaid, and Atomic were attributed by the FBI to Lazarus/APT38; WazirX was named in a joint statement by the United States, Japan, and South Korea in January 2025; CoinEx was only inferred by on-chain analysis firms. The Bitget case is suspected by multiple firms to be related to TraderTraitor, but none has formally attributed it.
According to TRM statistics, North Korea has carried out 100 cases since 2017, totaling about $12.8 billion; $7.4 billion so far this year; 85% of the total global crypto asset thefts in 2026 is attributed to North Korea. This table covers only twelve of them.
The people whose faces can be matched
There is more than one North Korean hacker named by U.S. officials for whom photos have also been released. Park Jin Hyok, Jon Chang Hyok, and Kim Il were all in the February 2021 indictment; in 2024, Rim Jong Hyok was added, with a $10 million reward.
Park Jin Hyok (Park Jin Hyok), wanted by the FBI
Park Jin Hyok was one of the earliest to be indicted: in June 2018, the U.S. Department of Justice filed criminal charges against him, and the indictment was unsealed in September of the same year. The indictment said the conspiracy he participated in included the 2014 Sony Pictures attack, the 2017 WannaCry attack, and the $81 million transferred from Bangladesh Bank in 2016. He remains at large and has never appeared in court.
Binance theft tracking
Binance has covered about 90% with company funds, the SAFU fund, and the futures insurance fund; the remaining 10% is illiquid tokens; the entire loss is borne by the company, not by users.
As of November 1, about $2.7 billion, or about 42%, had been frozen by stablecoin issuers and the Arbitrum Security Council. The attackers still hold 420,000 ETH and 18,270 BTC, about $2.4 billion.
The money laundering route is still standard practice: cross-chain bridges to switch chains, services such as THORChain to swap coins, mixers to mix and scatter many people's coins together, and finally over-the-counter trading.
There were some hiccups this time. THORChain recently accidentally delayed the laundering of the stolen funds in the Binance attack due to an Ethereum chain reorganization. This chain reorganization caused THORChain to mistakenly issue duplicate refunds to a user who deposited 10 ETH, which in turn triggered an emergency pause of the protocol, temporarily preventing all users from conducting cross-chain swaps, including the North Korean hacker group's money launderers.
Last time, the stolen funds from Bitget passed through THORChain, and THORChain did not freeze them at all, saying that decentralization means they cannot be frozen—but that is not what they said when they themselves were hacked last time. When THORChain resumes service, if the stolen funds from the Binance theft this time still pass through THORChain, it is unclear what excuse they will have to fob people off with.