TraderTraitor: The Kings of the Crypto Heist

WIRED

14-04-2025

Apr 14, 2025 6:00 AM Allegedly responsible for the theft of $1.5 billion in cryptocurrency from a single exchange, North Korea's TraderTraitor is one of the most sophisticated cybercrime groups in the world. ANIMATION: JAMES MARSHALL
On February 21, the largest crypto heist ever started to unfold. Hackers gained control of a crypto wallet belonging to the world's second-largest cryptocurrency exchange, Bybit, and stole almost $1.5 billion of digital tokens. They quickly shunted the money between dozens of cryptocurrency wallets and services to try and obscure the activity, before starting to cash the stolen funds out.
The eye-popping digital raid had all the hallmarks of being conducted by one of North Korea's elite subgroups of hackers. While Bybit remained solvent by borrowing cryptocurrency and launched a bounty scheme to track down the stolen funds, the FBI quickly pinned the blame on the North Korean hackers known as TraderTraitor.
Before the Bybit heist, TraderTraitor had already been linked to other high-profile cryptocurrency thefts and compromises of supply chain software.
'We were waiting for the next big thing,' says Michael Barnhart, a longtime cybersecurity researcher focused on North Korea and investigator at security firm DTEX Systems. 'They didn't go away. They didn't try to stop. They were clearly plotting and planning—and they're doing that now,' he says.
North Korea's hackers—alongside those from China, Russia, and Iran—are consistently considered to be one of the most sophisticated and most dangerous cyber threats to Western democracies. While all of these countries engage in espionage and theft of sensitive data, North Korea's cyber operations come with their own set of distinct goals: helping to fund the hermit kingdom's nuclear programs. Increasingly, that means stealing cryptocurrency.
Over at least the past five years, the totalitarian regime of Kim Jong-un has deployed technically skilled IT workers to infiltrate companies around the world and earn wages that can be sent back to the motherland. In some cases, after being fired, those workers extort their former employers by threatening to release sensitive data. At the same time, North Korean hackers, as part of the broad umbrella Lazarus Group, have stolen billions in cryptocurrency from exchanges and companies around the world. TraderTraitor makes up one part of the wider Lazarus group, which is run out of the Reconnaissance General Bureau, the North Korean intelligence agency.
TraderTraitor—which is also referred to as Jade Sleet, Slow Pisces, and UNC4899 by security companies—is primarily interested in cryptocurrency.
'They use a variety of creative techniques to get into blockchain, cryptocurrency, anything that has to do with platforms, trading forums, all of those different things that are around cryptocurrency and decentralized finance,' says Sherrod DeGrippo, the director of threat intelligence strategy at Microsoft. 'The Jade Sleet group [TraderTraitor] is one of the most sophisticated groups within that echelon,' she says.
TraderTraitor first emerged around the start of 2022, multiple cybersecurity researchers say, and is likely an offshoot of the North Korean APT38 group that hacked the SWIFT financial system and attempted to steal $1 billion from the Central Bank of Bangladesh at the start of 2016. 'They walked off with very little money,' says DTEX Systems's Barnhart. 'In that moment you had a real, significant shift.'
Barnhart says North Korea realized that relying on other people—such as money mules—could make their operations less effective. Instead, they could steal cryptocurrency. Two groups emerged from that tactical shift, Barnhart says, CryptoCore and TraderTraitor. 'TraderTraitor is the most sophisticated of all,' he says. 'And why? Because APT38 was the A team.'
Since then, TraderTraitor has been linked to multiple large-scale cryptocurrency thefts in recent years. For instance, the March 2024 theft of $308 million from Japan-based cryptocurrency company DMM has been linked to TraderTraitor by the FBI, Department of Defense, and police in Japan.
TraderTraitor typically targets people working at Web3 firms using spear-phishing messages—most often, people working on software development. 'They know the individuals that work at these companies, they track them, they have profiles on them, they know which trading platforms are doing the most volume. They're focused on that entire industry, understanding it backwards and forwards,' says Microsoft's DeGrippo.
GitHub, which is owned by Microsoft, highlighted in July 2023 how TraderTraitor created fake accounts on the coding platform, plus LinkedIn, Slack, and Telegram. The TraderTraitor criminals can create fake personas that they use to message their targets or use real accounts that have been hacked, GitHub's research says. In that instance, TraderTraitor invited developers to collaborate on GitHub, before ultimately infecting them with malware using malicious code. Recently, security researchers at Palo Alto Networks' Unit 42 threat intelligence team found 50 North Korean recruiter profiles on LinkedIn and linked them back to TraderTraitor.
The group has been seen using 'custom backdoors,' such as PLOTTWIST and TIEDYE, that target macOS, says Adrian Hernandez, a senior threat analyst at Google's Threat Intelligence Group. 'These are typically heavily obfuscated to prevent detection and thwart analysis,' Hernandez says. 'Once UNC4899 [TraderTraitor] has gained access to valid credentials, we've observed this threat actor moving laterally and accessing other accounts to access hosts and systems, keeping a low profile and aiming to evade detection.'
Once the North Korean hackers have their hands on cryptocurrency or digital wallets, the money laundering often follows a similar pattern, as cryptocurrency tracing firm Elliptic outlined in a blog post breaking down the Bybit hack. To avoid having cryptocurrency wallets frozen, they quickly swap stolen tokens—which are often issued by centralized entities and can have restrictions placed upon them—for more mainstream cryptocurrency assets like ether and bitcoin that are harder to limit.
'The second step of the laundering process is to 'layer' the stolen funds in order to attempt to conceal the transaction trail,' Elliptic writes. This means splitting the funds into smaller amounts and sending them to multiple wallets. With Bybit, Elliptic writes, money was sent to 50 different wallets that were then emptied in the coming days. This cryptocurrency is then moved through various cryptocurrency exchanges, converted into bitcoin, and passed through crypto mixers that aim to obscure crypto transactions.
'North Korea is the most sophisticated and well-resourced launderer of crypto assets in existence, continually adapting its techniques to evade identification and seizure of stolen assets,' Elliptic says in its blog post.
In addition to cryptocurrency heists, TraderTraitor has been linked to hacks at software supply chain companies, most prominently JumpCloud in June 2023. Compromising software used by multiple companies may provide the hackers a stealthier way into their intended targets. 'That could impact any tech industry, any organization that uses that software,' says Andy Piazza, senior director for threat research at Unit 42.
As TraderTraitor has increasingly garnered attention over the past couple of years, Piazza says he has seen the group improve their operations and attempt to evade detection. For example, Unit 42's recent research noted that TraderTraitor had been using malware the researchers called RN Loader that installs an information stealer and then deletes itself, making it harder to detect.
'You can definitely tell that they're stepping up,' Piazza says.
Piazza says that unlike haphazard Russian hacking groups—which were both in the networks of the DNC simultaneously around 2016—there appears to be more organization with the North Korean groups. 'It seems more coordinated that they're not bumping into each other out in the battle space,' Piazza says. 'They're really showing that they have the capability to be focused on that OPSEC, to be focused on that persistence capability.'
North Korea's hacking operations may be even more complex than many realize. According to Piazza and other experts WIRED spoke to, the crypto hackers and the undercover IT workers may even coordinate. Their tactics show some 'overlap,' Piazza says.
'If you right now went out onto some type of freelance website and said that you are a brand-new crypto startup and you're looking for developers before the day is out, you would have North Koreans in your inbox,' Barnhart, the DTEX Systems researcher, says. He says some North Korean hackers can bounce between the country's different groups, and there's the possibility that they could also work with or alongside its IT workers. There may be more overlap than people thought, Barnhart says.
'Whenever we attribute this [hacking] back to TraderTraitor, was nobody else involved? Did somebody else have a hand in there?'