North Korea's crypto hackers: who TraderTraitor is, how they work and how to protect yourself

When analysts started tracing the $6.3 billion stolen from Binance in October 2026, they pointed to a familiar name: TraderTraitor, a North Korean hacking group the FBI already blames for the $1.5 billion Bybit theft in 2025. This guide explains what US authorities have said about the group, how it lures its victims, and the precautions the FBI recommends.

For the hack itself, see the $6.3 billion Binance hack.

Who TraderTraitor is

In April 2022, the FBI, CISA and the US Treasury issued a joint advisory about a North Korean state-sponsored group stealing cryptocurrency since at least 2020. According to the advisory:

• the cybersecurity industry commonly tracks the group as Lazarus Group, APT38, BlueNoroff and Stardust Chollima;
• the name TraderTraitor comes from the malicious apps it used, which posed as crypto trading or price-prediction tools for Windows and macOS;
• once installed, the apps gave the attackers access to the victim’s computer, letting them spread through the network and steal private keys;
• the US government expected the group to keep targeting crypto firms “to generate and launder funds to support the North Korean regime”.

Who it targets

CISA’s advisory lists:

• crypto exchanges and DeFi protocols;
• play-to-earn crypto games;
• crypto trading companies and venture capital funds;
• individuals holding large amounts of crypto or valuable NFTs.

The attacks attributed to it

After the Bybit theft, the FBI said the attackers were “proceeding rapidly”, converting some of the stolen assets to bitcoin and other assets dispersed across thousands of addresses on multiple blockchains, and that it expected them to be laundered and eventually converted into regular currency. It asked exchanges, bridges, analytics firms and DeFi services to block transactions with the attackers’ addresses.

For Binance, TRM said several features matched earlier North Korea-linked thefts, including Bybit: small withdrawals from the mixing service Tornado Cash to fund the attacker’s wallet, preparation that began well before the theft, and signatures obtained in advance and used in one burst. The FBI said it was “aware of the incident and is engaged with relevant public and private partners”.

How the group gets in: social engineering

These thefts rarely start with a clever piece of code. They start with a person being tricked. In its 2022 advisory, CISA said intrusions began with large numbers of messages to employees of crypto companies, often in system administration or software development roles, that mimicked recruitment and offered high-paying jobs to get them to download the infected apps.

In a September 2024 warning, the FBI described the tactics in more detail. North Korean actors:

• research targets on social media, especially professional networking and job sites;
• build tailored fake scenarios, often a job or investment offer, using personal details about the target;
• impersonate recruiters, recruitment firms, technology companies, prominent people, or contacts the victim knows;
• usually write in fluent or nearly fluent English and know the technical side of crypto well;
• spend considerable time building trust before delivering malware.

The FBI says even people well versed in cybersecurity can fall for these schemes.

Warning signs

The FBI lists these possible indicators:

How to protect yourself

The FBI’s recommendations include:

1. Verify identities on a separate channel. If someone contacts you through a job site, confirm their request through a live video call on a different app.
2. Keep wallet secrets offline. Don’t store logins, passwords, wallet IDs, seed phrases or private keys on internet-connected devices. See how to protect your seed phrase.
3. Don’t run tests on work devices. If a job test requires running code, use a virtual machine on a device that isn’t connected to your company, or one the tester provides.
4. Require multiple approvals before moving significant funds. For individuals, see multisig wallets.

CISA’s advisory adds the basics: patch your systems, learn to recognize phishing, and use multifactor authentication. See SIM swaps and two-factor authentication and fake crypto apps and phishing sites.

If you think you’ve been targeted

The FBI recommends:

• disconnect the affected device from the internet immediately;
• leave it powered on, so evidence of the malware isn’t lost;
• file a detailed complaint at ic3.gov, with screenshots of the conversations and any usernames, accounts and other details about the people involved.

Outside the US, see how to report crypto scams.

Why it matters if you don’t work in crypto

Most of us will never be targeted by a state hacking group. But when an exchange is hit, its customers can be affected through paused withdrawals and uncertainty about who covers the losses. See when a crypto exchange is hacked, who pays? and hot vs cold wallets.