Mentioned in This Article
1. Who is TraderTraitor?
TraderTraitor is the North Korean hacking unit that the FBI and several blockchain analytics firms hold responsible for the $6.3 billion theft from Binance last week, the largest crypto heist on record. The theft is more than four times the $1.5 billion taken from Bybit in February 2025, an attack the FBI also assigned to the same group. Chainalysis and TRM Labs both say they attribute the Binance incident to TraderTraitor with high confidence.
The scale of the loss changes the arithmetic of North Korean crypto crime. In April, TRM Labs estimated that North Korean hackers had stolen more than $6 billion in total since 2017. A single raid on one exchange has now roughly matched that entire eight-year tally, which shows how quickly the proceeds are growing.
Ari Redbord, TRM Labs' global head of policy and government affairs, describes TraderTraitor as North Korea's elite crypto-theft unit, a team that sits inside the wider hacking apparatus researchers label Lazarus and concentrates on exchanges and custodians. Tom McLouth, a senior intelligence analyst at Chainalysis, uses plainer language, calling it a financially motivated North Korean threat group that prefers crypto businesses, institutions, DAOs and protocols as targets.
2. What do officials know about the group's history?
The name entered public circulation in an April 2022 advisory issued jointly by the FBI, the Cybersecurity and Infrastructure Security Agency and the U.S. Treasury Department. That notice described malware concealed inside trading applications and a pattern of attacks on exchanges, decentralized finance protocols and individual investors going back to at least 2020. The group is also followed under other labels, including Jade Sleet, UNC4899 and Slow Pisces, and all of them fall under the broader Lazarus banner.
American agencies have been consistent about the purpose of these operations: raising money for the government in Pyongyang. The 2022 warning predicted that the group would keep going after crypto companies to generate and launder funds for the regime. The money is not merely symbolic. North Korea has at least once attempted to use the USDT stablecoin to pay for Russian oil, which indicates that stolen assets are being put to practical use in a country cut off from much of the conventional financial system.
Pyongyang rejects the accusations. Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the FBI's finding as "absurd rhetoric." Investigators and analytics firms continue to rely on transaction tracing, malware analysis and the group's recurring habits to support their attributions.
3. How did the Binance attack begin?
It began with a job offer. Jimmy Su, Binance's Chief Security Officer, said that in September a software engineer at the exchange was approached by someone presenting as a project director. The pitch followed the same recruitment script seen in earlier attacks attributed to the group.
The approach was patient and layered. A person posing as a human resources representative interviewed the engineer and shared a social media account filled with personal photographs, a device meant to make the persona feel real. A second interview, this time with a supposed chief executive, ended with an instruction to download a coding assignment onto a work computer.
The file carried malware. According to Su's account, it later allowed the attackers to operate through that machine and through an internal AI tool in order to exploit Binance. In other words, the breach of the exchange's most valuable assets started with one employee opening one file during what looked like a normal hiring process.
Redbord frames the pattern as a hunt for people rather than code. He describes a fake recruiter, a fake interview and a single employee running a single file, repeated at scale, which is why he calls the group a "big game hunter." He adds that the operators stage their access for weeks, wait, and then move everything at once, and that each operation appears to take more than the last. In his view the group will continue for as long as it keeps succeeding.
4. Why does the group rely on social engineering?
The analysts quoted on the case agree that TraderTraitor is not a collection of programmers who outclass exchange security teams. Its method is to exploit human weaknesses instead of defeating hardened software. McLouth summarizes the approach by saying the operators exploit trust, not only technology, and he notes that attribution rests partly on the pretexts and preparation the group uses.
A 2024 case in Japan shows the template. In March of that year, a fake LinkedIn recruiter contacted an employee at Ginco, a Japanese company that makes wallet software. A supposed coding test hosted on GitHub contained malware that compromised the employee's computer. Two months later, the attackers used stolen session data to impersonate the employee and gain access to Ginco's communications, and they likely used that access to manipulate a genuine transaction request from the Japanese exchange DMM Bitcoin.
DMM lost about 4,503 bitcoin, valued at roughly $308 million at the time, and the loss contributed to the closure of the platform. Investigators tied the operation to TraderTraitor.
The pattern extends further back. The FBI has linked hackers affiliated with the group to thefts in 2023 from AlphaPo, which lost $60 million, CoinsPaid, which lost $37 million, and Atomic Wallet, which lost $100 million. Separately, forensic investigators at LayerZero concluded that the group was behind April's $292 million theft from the KelpDAO bridge. The Bybit hack and the Binance theft are therefore the largest entries in a long list rather than isolated events.
5. Where does the unit come from?
TraderTraitor's roots lie in a specialist crypto-theft team that North Korea's foreign intelligence agency, the Reconnaissance General Bureau, assembled around 2016 and 2017. An October 2025 report from the Multilateral Sanctions Monitoring Team, a body made up of 11 countries, places the group within the bureau's 110 Research Institute.
Redbord says the talent pipeline starts in childhood. Gifted children reportedly attend specialized science and mathematics schools, receive internet access that is denied to most citizens, and are sent to China. He compares the system to the way Russia trains gymnasts, with cybercrime as the discipline. The comparison is meant to convey that the output is the result of state investment over many years, not improvised criminal activity.
6. What do the hackers do once inside a company?
After gaining a foothold, the group looks for cloud-service logins and cryptographic keys that open broader access. McLouth cautions that holding a valid key does not prove the holder is a legitimate user, a point that matters because many security systems treat a correct credential as proof of identity.
He described one intrusion, without naming the victim, in which the hackers used administrator privileges to switch off multifactor authentication, slip in, and then switch it back on, leaving little visible trace. His advice to companies is to examine who is using credentials and under what circumstances, not simply whether the credentials are valid.
Simone Imbrescia, a vice president at the security firm Immunefi, makes a related argument. An attacker who compromises the operational layer of an exchange, she says, may not need a stolen private key or a flaw in a smart contract at all. The weak point is the set of people and procedures that approve transfers, which is exactly where fake recruiters aim.
7. How is the stolen money traced?
Chainalysis points to one piece of evidence as its strongest link between the Binance theft and North Korea: the stolen funds were combined with proceeds from September's roughly $388 million Bitget hack, which was also attributed to North Korean actors. Mixing the two sets of assets suggests a single operator managing the cash.
McLouth says TraderTraitor draws on a large pool of resources, tools and third parties, and that the group mostly works from outside North Korea, a conclusion he bases on partner data and legal actions. He adds that North Korean information technology workers now operate in dozens of countries and are becoming more decentralized, which complicates efforts to locate and disrupt them.
Theft is only half the objective. The group must also turn stolen digital assets into usable money, and over-the-counter traders in jurisdictions with weak oversight have converted crypto to fiat for it in the past. Because blockchain transactions are recorded permanently, investigators can follow the funds and look for points where transfers could be interrupted.
8. What should exchanges take from this?
The practical lesson from the analysts is that defense has to start earlier than the moment funds begin to move. McLouth puts it directly: security cannot begin when the funds move. He argues that studying how an intrusion unfolded deserves as much attention as studying how the proceeds were laundered, because the first compromise, often a single employee's laptop, is where the attack can still be stopped.
The record size of the Binance loss also raises the stakes for the rest of the industry. If a single unit can steal several billion dollars by persuading one engineer to open one file, then every platform that holds large customer balances faces the same exposure, whatever the strength of its code, and staff training becomes as important as audits.
For companies, that means treating recruitment approaches, take-home coding tests and unsolicited contact from strangers as potential entry points, and reviewing how session data, administrator rights and transfer approvals are protected. For regulators and investigators, the Binance case adds to evidence that the largest crypto thefts are now run by a patient state-backed organization that prepares for weeks and strikes once.