Understanding TraderTraitor: The Hacking Syndicate Behind the $6.3 Billion Binance Exploit

Nov 5, 2026, 11:58 a.m. EST

5 min read

Hackers and scammers. (Boitumelo/Unsplash)

Summary

North Korean cyber gang TraderTraitor was connected by the FBI to the record-breaking $6.3 billion Binance breach, following prior major incidents like Bybit and DMM Bitcoin.
The collective circumvents security barriers through advanced social engineering tactics, including fraudulent job interviews and recruiters targeting blockchain workers with malware.
Once inside, attackers hijack credentials, alter transfer permissions, and launder capital internationally, remaining a constant danger to digital asset organizations.

Major digital asset platform Binance suffered a massive $6.3 billion breach last week, an event which the FBI and multiple analytics firms linked to a North Korean hacking collective known as TraderTraitor.

This theft stands as the largest in digital asset history, more than four times the $1.5 billion siphoned from Bybit in February 2025, an operation the FBI also attributed to TraderTraitor.

The Binance incident essentially doubled in a single move the over $6 billion that TRM Labs estimated in April had been pilfered by North Korean operatives since 2017.

TraderTraitor operations consistently commence via employment outreach or the subversion of trusted software providers, according to FBI reports and Bybit’s inquiry. These intrusions granted their operators entry into the systems utilized for authorizing transfers.

TraderTraitor functions as North Korea’s premier division for pilfering digital assets, Ari Redbord, global head of policy and government affairs at TRM Labs, told CoinDesk. Lazarus serves as the broad umbrella for state-sponsored intrusions of all varieties, whereas TraderTraitor is the specialized cell created specifically to extract cryptocurrencies from exchanges and custodians.

The designation TraderTraitor surfaced within an April 2022 advisory issued jointly by the FBI, Cybersecurity and Infrastructure Security Agency, and the Treasury Department. The bulletin outlined malicious software hidden inside trading applications and assaults directed at exchanges, decentralized finance protocols, and investors dating back to at least 2020.

The collective is additionally designated as Jade Sleet, UNC4899, and Slow Pisces within the broader ecosystem of North Korean cyber operations commonly labeled Lazarus by researchers.

United States authorities state that their primary objective is acquiring capital for Pyongyang, cautioning in 2022 that these intruders would persist in targeting digital asset entities to generate and launder funds supporting the North Korean regime.

The North Korean government has previously attempted, on at least one occasion, to utilize USDT for purchasing Russian petroleum.

Tom McLouth, senior intelligence analyst at Chainalysis, noted in an interview with CoinDesk that TraderTraitor represents a financially driven DPRK threat unit that demonstrates a distinct preference for targeting cryptocurrency enterprises, institutions, DAOs, and protocols.

However, these are not the cinematic hackers typically depicted in films, possessing such extraordinary coding prowess that they outsmart exchange defenses. Their operational strategy differs entirely, relying instead on the exploitation of human vulnerabilities rather than AI-fortified code.

From recruitment to stolen funds

In March 2024, an individual posing as a recruiter on LinkedIn reached out to a staff member at Ginco, a Japanese wallet software provider. The recruiter delivered a supposed coding test hosted on GitHub, which actually contained malicious scripts that ultimately compromised the employee’s workstation.

Two months afterward, the culprits leveraged compromised session data to impersonate the worker and infiltrate Ginco’s communication network. Investigators indicated they likely utilized this access to alter a legitimate transaction request originating from Japanese exchange DMM Bitcoin.

DMM suffered a loss of approximately 4,503 bitcoin, valued at $308 million, a catastrophe that ultimately prompted the platform to shut down.

At the center of this operation was TraderTraitor—a threat actor that does not merely exploit technology, but rather targets trust, according to Chainalysis analyst McLouth.

One of the primary methods enabling the identification and attribution of data to TraderTraitor involves analyzing their pretexts and the remarkable preparation preceding their eventual attacks, he explained.

Their operational record extends far beyond those specific exchanges. The FBI connected hackers affiliated with TraderTraitor to the AlphaPo, CoinsPaid, and Atomic Wallet breaches in 2023, which resulted in losses of $60 million, $37 million, and $100 million respectively.

Forensic investigators at LayerZero concluded that the squad was similarly responsible for the $292 million KelpDAO bridge exploit in April.

During the Binance incident, the recruitment tactic resurfaced. Chief Security Officer Jimmy Su disclosed that a software engineer was approached in September by an individual masquerading as a project director.

A purported human resources representative conducted an interview with the engineer and shared a social media profile featuring personal photographs to establish credibility. A subsequent interview with a supposed chief executive concluded with instructions to download a coding task onto the employee’s work computer.

That package contained malware, which subsequently empowered the attackers to utilize that workstation alongside an internal artificial intelligence tool to compromise the planet’s largest cryptocurrency exchange.

TraderTraitor operates as a big game hunter, focusing on human targets before turning its attention to software, TRM Labs representative Redbord explained to CoinDesk. They execute sophisticated social engineering at scale, utilizing fake recruiters, fraudulent interviews, and a single employee executing a single file.

From that point onward, the syndicate exercises immense patience, lingering and staging for weeks before executing all movements simultaneously, he added. Furthermore, they appear to extract larger sums with each successive strike, a trend destined to persist as long as their methods yield results.

Both Chainalysis and TRM Labs express high confidence, based on numerous indicators, in attributing the Binance breach directly to TraderTraitor.

Built to steal crypto

The origins of TraderTraitor trace back to a specialized digital asset theft cell established between 2016 and 2017 by North Korea’s foreign intelligence arm, the Reconnaissance General Bureau.

An October 2025 assessment published by the Multilateral Sanctions Monitoring Team—an coalition of 11 nations monitoring sanctions violations by North Korea—positions TraderTraitor within the bureau’s 110 Research Institute. Entry into this specialized unit involves talent cultivation beginning in early childhood, according to Redbord.

Gifted children are placed into specialized science and technology academies, provided with internet access, and dispatched to China to cultivate their technical capabilities.

Consider how Russia historically developed elite gymnasts; the framework remains identical, with cybercrime serving as the chosen discipline, he noted.

Once inside a victim’s architecture, the syndicate searches for cloud-service credentials and cryptographic keys capable of providing broader access, explained Chainalysis analyst McLouth.

A valid key does not automatically guarantee a legitimate user, McLouth emphasized.

During one particular TraderTraitor intrusion, the operators leveraged administrative rights to disable multi-factor authentication, acquired full entry, and subsequently reactivated the security control, he informed CoinDesk, though he refrained from naming the affected organization.

Enterprises must carefully evaluate who is utilizing credentials and under what specific conditions, alongside verifying the mere validity of those credentials, he stated.

An adversary who breaches that operational layer may find it unnecessary to steal a key or uncover a smart-contract vulnerability, noted Simone Imbrescia, vice president at security firm Immunefi, earlier this year.

Following the money

Chainalysis reported that its most compelling evidence stems from stolen Binance capital being mingled with proceeds originating from the approximate $388 million Bitget breach in September, an event likewise linked to North Korea.

Pyongyang consistently denies any involvement. Kim Yo Jong, sister to supreme leader Kim Jong Un, dismissed the conclusions of the FBI as absurd rhetoric in an official statement.

TraderTraitor utilizes a diverse array of resources, tooling, and third-party services throughout the execution of their operations, McLouth remarked.

Although a common assumption places these threat actors directly inside Pyongyang, McLouth pointed out that they predominantly operate beyond North Korea’s borders, citing data collected from industry partners and legal enforcement actions.

A key insight gained from observing DPRK-related IT personnel is their deployment across dozens of international nations, indicating a trend toward decentralization, McLouth added.

Nevertheless, the ultimate aim of the syndicate extends beyond mere acquisition of funds, focusing heavily on laundering those assets into usable formats, he explained.

In previous operations, over-the-counter brokers have converted digital currencies into fiat money accessible to the North Korean government, often operating through trading entities situated in jurisdictions with minimal regulatory oversight.

These financial movements nevertheless generate transaction trails, enabling investigators to track the capital and identify conversion services where transfers can be disrupted, he stated.

Security cannot begin only after the funds start moving, McLouth emphasized, stressing that initial network intrusions warrant just as much scrutiny as subsequent laundering activities.