Who is TraderTraitor, The North Korean Hacking Unit Blamed For Binance's $6.36 Billion Hack?

Blockchain intelligence firm TRM Labs has blamed North Korea's TraderTraitor for the theft of about $6.36 billion from Binance, saying it made the judgment with high confidence on the basis of on-chain and off-chain intelligence. Binance has not yet confirmed who was behind the attack.

What is TraderTraitor?

TraderTraitor was originally a codename used by the US government for a cluster of North Korean state-sponsored cyber activity. It was named in an April 2022 joint advisory from the FBI, CISA and the US Treasury, which warned that the group was targeting crypto exchanges and DeFi protocols. Security firms track it under other names, including Jade Sleet, UNC4899 and Slow Pisces.

The group is widely described as a subunit of the Lazarus Group, North Korea's state-sanctioned hacking squad known for stealing money to fund the country's weapons programme. One analysis places it among the units controlled by North Korea's Reconnaissance General Bureau.

How it operates

TraderTraitor's usual method is social engineering. The FBI says it often targets several employees of the same company at once. In the 2024 attack on Japan's DMM Bitcoin, an attacker posed as a recruiter on LinkedIn and approached an employee of wallet firm Ginco. The employee ran code that installed a trojan, which gave the group a way into DMM Bitcoin's systems. Researchers have also tied the actor to a malicious npm package campaign that GitHub traced to Jade Sleet/TraderTraitor.

Its track record

- DMM Bitcoin (May 2024): the FBI, the US Department of Defense Cyber Crime Center and Japan's National Police Agency linked the theft of about 4,502.9 bitcoin, worth roughly $308 million, to TraderTraitor. The exchange was forced to wind down.

- Bybit (February 2025): the FBI attributed the record $1.5 billion hack to North Korean threat actors, which came through a Safe{Wallet} supply chain attack.

- Smaller thefts: the FBI has also linked the group to the Alphapo ($60 million), CoinsPaid ($37 million) and Atomic Wallet ($100 million) breaches.

Why TRM points to TraderTraitor

TRM says the Binance attack matches earlier North Korea-linked heists, including Bybit and the April 2026 KelpDAO hack. It cites small Tornado Cash withdrawals that funded an operator wallet, staging well before the theft, and signatures obtained in advance and executed in one burst. TRM believes the attackers compromised Binance's hot wallet signing infrastructure, and says preparation began at least 36 hours before the theft.

Binance has said it found no evidence of any wallet private key leak. Its preliminary findings point to a compromised employee laptop used to submit unauthorised withdrawals. Chainalysis CEO Jony Levin has likewise assessed that the hack was likely the work of TraderTraitor, and blockchain investigator ZachXBT called the attacker likely Lazarus.

Recovery efforts

The funds moved across 10 blockchains from 20:05 UTC on October 29, with most transfers completed in about 20 minutes. Tether, Circle, Ripple, World Liberty Financial and Arbitrum's Security Council have frozen about $2.7 billion in assets, while an estimated $2.4 billion remains beyond their reach. One CoinDesk trace found 18,270 bitcoin, worth about $1.4 billion, split across 19 wallets that no one can freeze.