TraderTraitor

On attribution: TraderTraitor is a North Korea-linked cluster within the broader Lazarus/RGB umbrella. Attributions are those of the cited authorities (FBI and partner agencies).

Overview

TraderTraitor is the name U.S. agencies use for a North Korea-linked cyber actor (overlapping with the Lazarus umbrella; also tracked by industry as Jade Sleet, UNC4899, and Slow Pisces). It specializes in high-value cryptocurrency theft via targeted social engineering — often impersonating recruiters or business contacts to compromise employees — and via software supply-chain attacks. The name originally referred to a 2022 campaign pushing trojanized crypto trading apps. ^[1][2]

Tactics

The group frequently contacts employees of crypto firms (developers, operations, finance) with fake job offers, "coding tests," or partnership pitches, then delivers malware or harvests credentials/session tokens. It has also poisoned software dependencies (e.g. npm packages) to reach downstream targets. A recurring hallmark is targeting several employees of the same company at once. ^[1][2]

Notable incidents

• Bybit (Feb 2025, ~$1.5B) — the largest crypto heist on record; the actor compromised the Safe{Wallet} signing interface so signers approved a malicious transaction. ^[1]
• DMM Bitcoin (May 2024, ~$305M) — compromised an employee at wallet vendor Ginco via a fake "pre-employment test," then manipulated a legitimate transaction. ^[2]
• Ronin / Axie Infinity bridge (2022, ~$625M) — the cluster is also linked to this theft, which began with a fake job lure to a Sky Mavis engineer.

Bracketed numbers refer to the numbered sources listed below.