From Binance to Bybit: The North Korean Hacker Network Behind TraderTraitor

On November 1, the FBI issued an advisory that attributed the $6.3 billion stolen from Binance on October 29 to North Korea. The advisory used one term: TraderTraitor.

Search that name and you will find that Bybit's $1.5 billion, Bitget's $300 million, and several major crypto cases from earlier years are all connected to it.

TraderTraitor is not a company, and it is not a box on an organizational chart. It is a codename the U.S. government gave to a category of behavior.

In April 2022, the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. Department of the Treasury jointly issued an advisory, numbered AA22-108A. That was the first formal appearance of the term. At the time it referred to several trojans disguised as crypto trading software — DAFOM, TokenAIS and CryptAIS — with convincingly built interfaces that began stealing private keys as soon as they were installed.

The people behind this have long been called Lazarus Group, APT38, BlueNoroff and Stardust Chollima in the industry. These are not four teams. Lazarus is the umbrella name; APT38 (Mandiant), BlueNoroff (Kaspersky) and Stardust Chollima (CrowdStrike) are three names different security companies gave to the same money-making line.

Two years later, the label attached to specific conduct. On December 23, 2024, the FBI, the U.S. Department of Defense Cyber Crime Center and Japan's National Police Agency jointly published the attribution for the $300 million DMM theft, using for the first time the phrasing "North Korean cyber actors tracked as TraderTraitor," and listing its three aliases: Jade Sleet (Microsoft's name), UNC4899 (Google's name) and Slow Pisces (Palo Alto's name).

The picture is now fairly clear: TraderTraitor is the part of the larger Lazarus group that specializes in crypto assets, and it is the most lucrative part today. Since at least 2020 it has focused only on blockchain — trading platforms, DeFi, wallet service providers, crypto funds, and individuals holding large amounts of coins.

From robbing banks to robbing trading platforms

Lazarus is an umbrella name that covers everything: wiping Sony Pictures' hard drives in 2014, moving money out of Bangladesh's central bank in 2016.

Take the Bangladesh central bank case — those behind it were then called APT38, also known as BlueNoroff. In February 2016 they forged SWIFT instructions (the international messaging system banks use to transfer funds between each other), trying to move $1 billion out of Bangladesh Bank's account at the New York Fed. They ended up with $81 million, because a spelling error in one transfer got it stopped by an intermediary bank.

That craft — studying a bank's operating procedures, finding the gaps in human review, forging instructions — was later transplanted unchanged onto crypto trading platforms.

Around 2020. They began upgrading their methods, with crypto as the target. The reason is easy to guess: there is money, there is no regulation, and liquidity is decent.

There are several ways they go about it.

The first is fake recruiting. A headhunter finds you on LinkedIn, the conversation goes well, and finally they send a "pre-onboarding coding test," or an installer for an "internal tool." Install it, and the machine is theirs. Ronin's $620 million disappeared exactly this way.

The second is the supply chain. No more deceiving people — instead they contaminate developers' toolchains: malicious repositories on GitHub, poisoned packages on npm, identity providers like JumpCloud. One person is compromised, and a string of companies downstream goes with them.

The third is directly altering transactions. In the Japanese DMM case, they stole the counterparty's login credentials, slipped into the internal communications of the wallet company Ginco, and then altered a transfer that should have been normal. In the Bybit case, they hacked a Safe{Wallet} developer's computer and injected a script into the web front end: the person signing still saw a normal page, but what got signed was a different transaction.

That includes Binance this time.

The attackers prepared 36 hours in advance and signed 50 EIP-7702 authorizations — a new Ethereum feature that lets a wallet temporarily "rent" a piece of code — and then had Binance's hot wallet move the money out itself: 40 minutes, across 10 networks. One security firm's conclusion is that they very likely had already got their hands on Binance's signing system.

How much this group has stolen

The twelve best-known cases: $9.7 billion.

Binance alone accounts for $6.3 billion. The other eleven, from 2022 to 2026, add up to $3.44 billion in total.

Bybit $1.5 billion, from an altered front end; Ronin $620 million, from a fake job offer that was opened; Bitget $388 million, from forged withdrawal instructions written into a wallet system.

DMM $308 million, WazirX $235 million, Harmony and Atomic $100 million each, Alphapo $60 million, CoinEx $55 million, Stake $41 million, CoinsPaid $37 million.

In the chart, only Binance, Bybit and DMM have been directly named TraderTraitor by the U.S. government. Ronin, Harmony, Stake, Alphapo, CoinsPaid and Atomic were attributed by the FBI to Lazarus/APT38; WazirX was named in a January 2025 joint statement by the U.S., Japan and South Korea; CoinEx rests only on inferences by on-chain analytics firms. In the Bitget case, multiple firms suspect a link to TraderTraitor, but none has formally attributed it.

TRM counts 100 incidents by North Korea since 2017, totaling about $12.8 billion; $7.4 billion year to date; and 85% of the total crypto assets stolen worldwide in 2026 is booked to North Korea. This table is only twelve of them.

Faces you can put to a name

More than one North Korean hacker has been named by U.S. officials and has a photo on record. Park Jin Hyok, Jon Chang Hyok and Kim Il were all in the February 2021 indictment; in 2024 Rim Jong Hyok was added, with a $10 million reward.

Park Jin Hyok, wanted by the FBI

Park Jin Hyok was among the first to be charged: in June 2018 the U.S. Department of Justice filed criminal charges against him, unsealed that September. The indictment said his conspiracies included the 2014 Sony Pictures attack, WannaCry in 2017, and the $81 million transferred out of Bangladesh's central bank in 2016. He remains at large to this day and has never appeared in court.

Tracking the Binance theft

Binance has already covered about 90% using corporate funds, the SAFU fund and the futures insurance fund; the remaining 10% is in illiquid tokens. The entire loss is borne by the company, not by users.

As of November 1, about $2.7 billion, roughly 42%, has been frozen by stablecoin issuers and the Arbitrum Security Council. The attackers still hold 420,000 ETH and 18,270 BTC, about $2.4 billion.

The laundering route is standard practice: cross-chain bridges to switch chains, services like THORChain to swap coins, mixers to churn many people's coins together and break them up, and finally over-the-counter trading.

There was a small interlude this time: THORChain recently, because of an Ethereum chain reorganization, unexpectedly delayed the laundering of the funds stolen in the Binance attack. The reorganization caused THORChain to mistakenly issue a duplicate refund to a user who had deposited 10 ETH, which in turn triggered an emergency pause of the protocol, temporarily preventing all users from doing cross-chain swaps — including the North Korean hacker group's launderers.

Last time, the stolen Bitget funds went through THORChain, and THORChain did not freeze a single cent, saying that a decentralized system cannot freeze; but that is not what it said the last time it was hacked itself. When THORChain resumes service, if the Binance loot passes through THORChain again this time, it is hard to say what excuse they will have left.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps