Blockchain analysts immediately identified TraderTraitor when $6.3 billion disappeared from Binance’s wallets in less than 20 minutes.
“TraderTraitor” is a term used by cybersecurity researchersWho is behind TraderTraitor? Inside North Korea’s hacking network and blockchain intelligence companies to describe a state-sponsored hacking team
It is commonly regarded as a component of the Lazarus Group, the more general term for Pyongyang’s cyberwarfare organization, which has been connected to operations since about 2009, such as the 2016 Bangladesh Bank heist and the 2014 Sony Pictures hack.
The term “TraderTtor” refers to a family of malware that posed as trustworthy bitcoin trading software in order to entice professionals in the field. The squad is “North Korea’s elite hacking unit,” according to TRM Labs, which cited “strong on- and off-chain intelligence” to “very confidently” ascribe the Binance attack to it.
Similar findings were made by Singapore-based Pangolin intelligence and Chainalysis.
It was simple to identify its fingerprints. The Bybit hack, which involved a $1.5 billion theft in February 2025, and the KelpDAO hack, which occurred in April 2026, were similar to the Binance hack in three ways, according to TRM: small withdrawals from Tornado Cash; preparation, which was done well in advance of the crime; and signatures collected in advance and executed all at once.
Experts claim that this unit serves as a source of revenue for the government affected by the sanctions. The BBC cited Dr. Edward Howell of Oxford University as saying that “around 40 to 50% of North Korea’s weapons of mass destruction programs are funded by cyber and cryptocurrency warfare.”
However, North Korea has consistently denied any role in such crimes. Its Geneva mission has not addressed the accusations. But TraderTraitor has already been associated by the FBI with significant cryptocurrency thefts.
