What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist

Leading cryptocurrency exchange Binance suffered a $6.3 billion heist last week, which the FBI and various analysis firms attributed to a North Korean hacking squad known as TraderTraitor.

The theft was the largest in crypto history, more than four times the $1.5 billion stolen from Bybit in February 2025, an attack the FBI also blamed on TraderTraitor.

The Binance theft roughly doubled in one swoop the more than $6 billion TRM Labs estimated in April that North Korean hackers had stolen since 2017.

TraderTraitor’s attacks have repeatedly begun with recruitment pitches or compromises of trusted software suppliers, according to FBI findings and Bybit’s investigation. Those breaches gave its hackers access to the systems used to approve transfers.

TraderTraitor is North Korea's elite unit for stealing cryptocurrency,” Ari Redbord, TRM Labs’ global head of policy and government affairs, told CoinDesk. “Lazarus is the umbrella for the regime's hacking of every kind. TraderTraitor is the team inside it built to take digital assets from exchanges and custodians.”

The name TraderTraitor appeared in an April 2022 advisory from the FBI, Cybersecurity and Infrastructure Security Agency and Treasury Department. It described malware hidden in cryptocurrency trading apps and attacks on exchanges, decentralized finance protocols and investors dating to at least 2020.

The group is also tracked as Jade Sleet, UNC4899 and Slow Pisces, within the broader network of North Korean hacking operations researchers commonly call Lazarus.

U.S. agencies say its purpose is to raise money for Pyongyang, warning in 2022 that the hackers would keep targeting crypto companies “to generate and launder funds to support the North Korean regime.”

The North Korean government has, at least on one occasion, attempted to use USDT to buy Russian oil.

Tom McLouth, a senior intelligence analyst at Chainalysis, told CoinDesk in an interview that TraderTraitor is a “financially motivated DPRK threat group that has a preference for targeting cryptocurrency-related organizations, institutions, DAOs, protocols, what have you.”

But these aren’t the hackers we see in movies, so outstandingly skilled at code they outperform crypto exchanges’ security. They have a different modus operandi, one that exploits human weaknesses rather than AI-hardened code.

From recruitment to stolen funds

In March 2024, someone posing as a LinkedIn recruiter contacted an employee of Ginco, a Japanese wallet software company. The recruiter sent the employee a supposed coding test hosted on GitHb, but within it was malicious code that ended up compromising the employee’s computer.

While a common assumption would be that these threat actors are operating out of Pyongyang, McLouth said they mostly operate outside North Korea, citing data from partners and legal actions

“One thing we've learned from looking at DPRK-related IT workers is that they're operating in dozens of countries internationally, and that they are starting to become decentralized,” McLouth added.

The group’s objective, however, goes beyond taking funds. “It’s getting these funds laundered and having it in a usable format,” he said.

In previous operations, he said, over-the-counter traders have ended up converting crypto into fiat currencies that the North Korean government can then use. These are often trading entities operating in jurisdictions with little to no regulatory oversight.

Those movements still leave transaction records. Investigators can use them to trace the proceeds and identify services where transfers or conversions can be disrupted, he said.

“Security can’t begin when the funds move,” McLouth said. The intrusion before the theft needs to be studied as closely as the laundering afterward.