\n<\/p>\n
Blockchain analysts immediately identified TraderTraitor when $6.3 billion disappeared from Binance\u2019s wallets in less than 20 minutes.<\/strong><\/p>\n \u201cTraderTraitor\u201d is a term used by cybersecurity researchersWho is behind TraderTraitor? Inside North Korea\u2019s hacking network and blockchain intelligence companies to describe a state-sponsored hacking team<\/p>\n It is commonly regarded as a component of the Lazarus Group, the more general term for Pyongyang\u2019s cyberwarfare organization, which has been connected to operations since about 2009, such as the 2016 Bangladesh Bank heist and the 2014 Sony Pictures hack.<\/p>\n The term \u201cTraderTtor\u201d refers to a family of malware that posed as trustworthy bitcoin trading software in order to entice professionals in the field. The squad is \u201cNorth Korea\u2019s elite hacking unit,\u201d according to TRM Labs, which cited \u201cstrong on- and off-chain intelligence\u201d to \u201cvery confidently\u201d ascribe the Binance attack to it.<\/p>\n Similar findings were made by Singapore-based Pangolin\u00a0 intelligence and Chainalysis.<\/p>\n It was simple to identify its fingerprints. The Bybit hack, which involved a $1.5 billion theft in February 2025, and the KelpDAO hack, which occurred in April 2026, were similar to the Binance hack in three ways, according to TRM: small withdrawals from Tornado Cash; preparation, which was done well in advance of the crime; and signatures collected in advance and executed all at once.<\/p>\n Experts claim that this unit serves as a source of revenue for the government affected by the sanctions. The BBC cited Dr. Edward Howell of Oxford University as saying that \u201caround 40 to 50% of North Korea\u2019s weapons of mass destruction programs are funded by cyber and cryptocurrency warfare.\u201d<\/p>\n However, North Korea has consistently denied any role in such crimes. Its Geneva mission has not addressed the accusations. But TraderTraitor has already been associated by the FBI with significant cryptocurrency thefts.<\/p>\n<\/div>\n