The FBI announced that the North Korean hacking unit TraderTraitor was behind the largest digital heist in history: the theft of $6.3 billion from Binance, the world's largest cryptocurrency exchange. Binance says it has already covered 95% of the losses with its own funds and resumed withdrawals on Sunday. But one major question remains: Who exactly is the group that has stolen sums approaching the budgets of entire countries in just four years?
TraderTraitor has no office, spokesperson or website. It is the name the U.S. government has given to the operations of a North Korean hacking group that specializes almost exclusively in one thing: stealing cryptocurrency. Each cybersecurity company uses a different name for the group. Microsoft calls it Jade Sleet, Google's Mandiant calls it UNC4899 and Palo Alto Networks calls it Slow Pisces. The FBI, Japanese police and U.S. Department of Defense use these names interchangeably in official documents to describe the same operation.
The group belongs to a broader network known internationally as Lazarus Group, an umbrella term for several cyber units operating on behalf of the regime in Pyongyang. Western governments believe most of these units answer to the Reconnaissance General Bureau, North Korea's military intelligence agency. When the U.S. government first identified TraderTraitor, it described the group as an operation also known in the cybersecurity industry as Lazarus, APT38, BlueNoroff and Stardust Chollima.
The goal: Money and missiles
Unlike most state-sponsored hackers, who focus primarily on espionage, TraderTraitor is first and foremost a revenue-generating machine. North Korea faces severe international sanctions and is largely cut off from the global financial system. Cryptocurrency allows it to circumvent those restrictions. The United States, Japan and South Korea have jointly stated that efforts to combat these thefts are intended to deprive the regime of revenue used to finance its weapons of mass destruction and ballistic missile programs. According to blockchain analytics firm Chainalysis, international officials believe Pyongyang uses stolen cryptocurrency for precisely those purposes.
In April 2022, the FBI, the U.S. Cybersecurity and Infrastructure Security Agency and the Treasury Department issued a joint advisory. It marked the first public appearance of the name TraderTraitor. According to the advisory, the group had been targeting blockchain and cryptocurrency companies since at least 2020. Its targets include exchanges, decentralized finance projects, play-to-earn games, venture capital funds investing in cryptocurrency and individuals with substantial cryptocurrency holdings. The name itself reflects the group's methods: cryptocurrency trading applications that appear entirely legitimate but are actually Trojan horses.
Social engineering is one of the group's principal tactics. Its hackers pose as recruiters on LinkedIn, approach employees at cryptocurrency companies with purported job opportunities and send them pre-employment tests containing malicious code.
Binance
(Photo: Reuters)
That was how the Japanese exchange DMM Bitcoin was compromised in 2024. A hacker posing as a recruiter contacted an employee at Ginco, a cryptocurrency wallet software company. The hacker sent the employee a Python script presented as a preliminary employment test. About two months later, the hackers used the access they had obtained to manipulate a legitimate transfer request made by an exchange employee, stealing 4,502.9 bitcoins worth $308 million. The FBI noted that one distinguishing feature of the group is its practice of targeting multiple employees at the same company simultaneously.
Another method involves supply chain attacks. Instead of breaking directly into a target's systems, the hackers infiltrate a trusted software provider. In 2023, Mandiant attributed a breach of identity management company JumpCloud to UNC4899. The attackers used the company as a potential gateway to customers in the cryptocurrency industry.
The 2022 advisory came shortly after the heist that brought the group widespread attention: the March 2022 breach of the Ronin bridge used by the game Axie Infinity. Approximately $620 million was stolen, and the FBI attributed the theft to Lazarus. In June of that year, the Horizon bridge operated by Harmony was hacked, resulting in the theft of approximately $100 million. Once again, the FBI pointed to Lazarus.
In 2023, the attacks expanded to private wallets and gambling websites. Approximately $100 million was stolen from users of Atomic Wallet, while the cryptocurrency gambling platform Stake.com lost about $41 million. The FBI attributed both incidents to North Korea.
The year 2024 was a record year for the group at the time. In addition to the DMM Bitcoin breach, the United States and South Korea attributed the theft of $235 million from Indian exchange WazirX and $50 million from Radiant Capital to North Korea. The United States, Japan and South Korea also blamed North Korea for the theft of $50 million from South Korean exchange Upbit.
Then came February 2025. Approximately 401,000 ether tokens worth nearly $1.5 billion were stolen from cryptocurrency exchange Bybit. The hackers compromised the computer of a developer at Safe, which provided Bybit with its wallet interface, and planted malicious code. When the exchange approved what appeared to be a routine transfer, it was actually authorizing the transfer of funds to the attackers. The FBI attributed the heist to TraderTraitor within just five days.
North Korean leader Kim Jong Un inspects weapons at a munitions factory
(Photo: KCNA via REUTERS )
The numbers behind the operation
According to Chainalysis, North Korean hackers stole approximately $660 million in 2023 and $1.34 billion across 47 attacks in 2024. That accounted for 61% of all cryptocurrency stolen worldwide that year. In 2025, they stole at least $2.02 billion, an annual record driven largely by the Bybit heist, and were responsible for 76% of the value stolen in attacks on cryptocurrency companies. By the end of 2025, Chainalysis estimated that North Korean hackers had stolen at least $6.75 billion in total — almost exactly the amount now stolen from Binance in a single heist.
One finding in the report helps explain the trend: The number of attacks has declined, but the amounts stolen have soared. The group is no longer attacking targets indiscriminately. Instead, it is focusing on the biggest prizes. It places North Korean IT workers inside cryptocurrency companies, impersonates senior executives and, after each heist, carries out a money laundering process lasting approximately 45 days, using cryptocurrency swap services, cross-chain bridges and mixing services.
The Binance breach combines everything the group has learned over six years of operations: exploiting human vulnerabilities to gain initial access, deploying software that erases its tracks, taking control of transaction-signing mechanisms and rapidly laundering stolen funds through new methods.
The previous record, the Bybit heist, stood at approximately $1.5 billion. The Binance theft is more than four times as large. Binance customers are not expected to suffer any losses, but according to the FBI, the laundering of the stolen funds has only just begun.