Edit: TraderTraitor — CryptoScamsWiki

Title / name *

Summary *

Category *

Scam type *

Severity *

Chain

Token

Amount lost (USD)

Image

Upload

Paste a link or upload a file (max 5 MB).

Details (Markdown supported)

> **On attribution:** TraderTraitor is a North Korea-linked cluster within the broader Lazarus/RGB umbrella. Attributions are those of the cited authorities (FBI and partner agencies).

## Overview

TraderTraitor is the name U.S. agencies use for a North Korea-linked cyber actor (overlapping with the Lazarus umbrella; also tracked by industry as Jade Sleet, UNC4899, and Slow Pisces). It specializes in high-value cryptocurrency theft via targeted social engineering — often impersonating recruiters or business contacts to compromise employees — and via software supply-chain attacks. The name originally referred to a 2022 campaign pushing trojanized crypto trading apps. [1][2]

## Tactics

The group frequently contacts employees of crypto firms (developers, operations, finance) with fake job offers, "coding tests," or partnership pitches, then delivers malware or harvests credentials/session tokens. It has also poisoned software dependencies (e.g. npm packages) to reach downstream targets. A recurring hallmark is targeting several employees of the same company at once. [1][2]

## Notable incidents

- **Bybit (Feb 2025, ~$1.5B)** — the largest crypto heist on record; the actor compromised the Safe{Wallet} signing interface so signers approved a malicious transaction. [1]
- **DMM Bitcoin (May 2024, ~$305M)** — compromised an employee at wallet vendor Ginco via a fake "pre-employment test," then manipulated a legitimate transaction. [2]
- **Ronin / Axie Infinity bridge (2022, ~$625M)** — the cluster is also linked to this theft, which began with a fake job lure to a Sky Mavis engineer.

_Bracketed numbers refer to the numbered sources listed below._

Aliases (one per line)

Wallets (chain:address per line)

Propose an edit