Meet TraderTraitor: The North Korean Hackers Behind the Binance Heist
When about $6.3 billion left Binance in 20 minutes on October 29, blockchain investigators had a suspect within hours. TRM Labs said it was "high confidence" that the attack came from a North Korean state-backed hacking unit called TraderTraitor. Chainalysis agreed, and the FBI has since named the same group.
If the name is new to you, the group isn't. It has been behind several of the biggest crypto thefts on record, and it uses the same simple playbook over and over. That playbook is worth understanding, because it works on any company, not just crypto exchanges.
(For the plain-English story of the heist itself, see The $6.3 Billion Binance Hack, Explained Simply.)
Who they are
TraderTraitor is a hacking group that works for the North Korean government. US officials say the money it steals pays for the government and its weapons programs. It has been active since at least 2020.
One thing that makes the group confusing to follow is that every security company gives it a different name. Depending on who's writing, you'll see Jade Sleet (Microsoft), UNC4899 (Google's Mandiant), Slow Pisces (Palo Alto Networks), Pressure Chollima or PUKCHONG. In its 2022 warning about the group, the US government tied it to the wider North Korean operation that security firms call the Lazarus Group or APT38.
The name "TraderTraitor" originally came from the fake crypto-trading apps the group used to infect people. That's a good hint about how it works.
Why a country robs crypto companies
North Korea is cut off from most of the world's banking system. Crypto is a way around that: it can be stolen from anywhere, moved quickly, and swapped into other assets. UN investigators estimate North Korea stole about $3 billion in crypto from 2017 to 2023, and more than $2 billion in 2025 alone. The Binance theft by itself is about three times the 2025 total.
That money is the reason this group is so patient and so well resourced. For them, a single successful heist can be worth months of planning.
The playbook: six steps they repeat
Public reports from the FBI, CISA and security researchers describe the same pattern again and again.
- Find the person with the keys. They pick employees with powerful access, usually software developers, system administrators and DevOps engineers, the people who run the systems that move money.
- Pose as a recruiter. The first contact is a job offer, often on LinkedIn, with a polished profile and a well-paid role. Microsoft has reported that the group now uses AI to build convincing fake personas and messages.
- Send a "coding test." The candidate gets a take-home exercise or a sample app to run. It's malware. Over the years it has come as fake trading apps, booby-trapped Python scripts, poisoned npm packages and, most recently, tampered Terraform tools that install an infostealer and a backdoor.
- Become that employee. Once the malware is on a work laptop, they take what that person is trusted with. In the DMM Bitcoin case, the FBI said the attackers used stolen session cookie information to impersonate the employee, which means they never had to pass a login or MFA check themselves.
- Wait and prepare. They are patient. In the DMM case about two months passed between the first recruiter message and the theft. At Binance, preparation began at least a day and a half before the money moved.
- Strike fast, then launder. When they move, they move everything at once, then scatter it across blockchains, swap services and mixers like Tornado Cash before anyone can freeze it.
Notice what's missing: there's no exotic hack of the bank vault. The whole thing works by tricking one trusted person and then borrowing their access.
Their track record
DMM Bitcoin (May 2024): about $308 million
A fake LinkedIn recruiter approached an employee at Ginco, a Japanese company that provided wallet software to the DMM Bitcoin exchange. The "pre-employment test" had the employee copy malicious Python code into their own GitHub. The attackers then used the employee's session cookies to get into Ginco's systems, and in late May they tampered with a real DMM transaction. 4,502.9 Bitcoin were gone.
Bybit (February 2025): about $1.5 billion
This time they went after a supplier. A developer machine at Safe{Wallet}, the wallet software Bybit used, was compromised. Researchers found that code on Safe's website was quietly swapped two days before the theft, so that when Bybit's staff approved what looked like a normal transfer, they were actually signing a disguised malicious one. At the time it was the largest crypto theft ever.
KelpDAO (April 2026): about $290 million
Investigators have linked this theft from the crypto platform KelpDAO to the same group. Fewer details about how it worked have been made public.
Binance (October 2026): about $6.3 billion
Binance has said the breach may have started with a compromised DevOps engineer's laptop, which gave the attackers access to an internal system that could request withdrawals. Binance says it found no sign its wallet keys were leaked. TRM Labs says the withdrawals were signed in advance and released together across about ten blockchains. How the laptop was compromised hasn't been made public. Given everything above, a fake job offer would fit the pattern, but that hasn't been confirmed.
Figures differ a little by source. Estimates of the Binance loss range from $6.3 billion to $6.43 billion, and of the amount frozen from about $2.7 billion to $3 billion.
Why this should worry companies that don't touch crypto
Nothing in this playbook is specific to crypto. Fake recruiters, malicious "coding tests" and stolen session cookies work just as well against a payroll system, a cloud console or a customer database. North Korea happens to want crypto. Ransomware gangs and data thieves use the same moves to get other things.
And the target isn't really the company's technology. It's the people who are trusted to use it, and the fact that once someone has signed in, most systems stop asking whether it's really them.
How to defend against it
- Warn your technical staff about fake recruiters. Developers and DevOps engineers are the targets. Make it a rule that no one runs a "take-home test" or a stranger's code on a work machine.
- Separate work and personal life on devices. Job hunting, personal GitHub accounts and side projects shouldn't happen on the laptop that can reach production.
- Limit what any one person can do. The US government's own advice for this group starts with least privilege and network segmentation. Big transfers should need more than one person.
- Watch for strange logins and strange bursts. CISA specifically advises monitoring for unusual logins. Automatic limits on how much can leave at once buy time to react.
- Don't let a stolen session stand in for a person. MFA at login is necessary but not enough when the attacker can copy the session afterwards. Sensitive access should keep checking that the real person is actually there.
Where NearAuth.ai fits
That last step is what NearAuth.ai does. It checks that your registered phone is next to your registered computer, using an encrypted Bluetooth handshake signed with keys that stay on the devices, and it keeps checking during the day instead of trusting one morning login. An attacker running stolen cookies from another machine doesn't have your phone in their pocket.
To be clear about the limits: if the attacker is running code directly on the employee's own laptop while the employee sits at their desk, the phone is right there too. Presence checks don't replace endpoint protection, least privilege or the other steps above. What they remove is the attacker's easiest move, quietly using a trusted person's access from somewhere else. That move shows up in almost every case above.
TraderTraitor's real skill isn't writing malware. It's finding the one person who can open the vault and getting them to run something. The best defense is making sure that person's access only works when that person is really there.
NearAuth.ai is free for teams of up to 12 people, and most teams protect their first five people in about 15 minutes with Google Workspace or Microsoft 365.
chris@nearauth.ai