tradertraitor

Most people have heard of the Lazarus Group, but far fewer know about TraderTraitor — one of the most notorious names associated with North Korea’s state-sponsored cyber operations.
TraderTraitor is not an ordinary hacking group. It is a name used by the FBI to track specific North Korean cyber operations targeting cryptocurrency and blockchain companies.
Here is what makes this group so significant:
🔹 State-Sponsored Operations
The FBI, CISA, and U.S. Treasury have identified TraderTraitor as North Korean state-sponsored cyber activity. It is also associated with the broader Lazarus Group ecosystem.
🔹 Connections to North Korea’s Intelligence Agency
In September 2019, the U.S. Treasury identified Lazarus Group as a North Korean government-controlled entity connected to the Reconnaissance General Bureau (RGB), the country's primary intelligence agency.
🔹 The $1.5 Billion Bybit Hack
On February 21, 2025, Bybit suffered a massive cryptocurrency theft worth approximately $1.5 billion.
On February 26, 2025, the FBI officially attributed the attack to North Korea and referred to the specific malicious cyber activity as TraderTraitor.
🔹 The $308 Million DMM Bitcoin Theft
In May 2024, North Korean cyber actors associated with TraderTraitor stole approximately $308 million from Japan-based DMM Bitcoin.
Investigators revealed that the attackers used a fake LinkedIn recruiter identity and a malicious coding test to compromise an employee.
🔹 A Much Longer History
North Korean cyber operations have also been linked to several major incidents:
• 2016 Bangladesh Bank heist — approximately $81 million stolen, involving Lazarus Group and its associated financial cyber operations.
• 2014 Sony Pictures cyberattack — attributed to North Korea by the FBI and linked to Lazarus Group.
• 2022 Axie Infinity Ronin Bridge hack — approximately $620 million stolen, attributed to Lazarus Group by the FBI.
🔹 Where Does the Money Go?
According to the U.S. Treasury, North Korea uses illicit cyber operations and cryptocurrency theft to generate revenue for the regime, including funding its weapons of mass destruction and ballistic missile programs.
The exact amount of stolen money that reaches specific government programs is difficult to independently establish.
The Bigger Picture
TraderTraitor represents a growing challenge for the global cryptocurrency industry.
These operations do not always begin with sophisticated code. Sometimes, they start with a fake job offer, a LinkedIn message, or a seemingly harmless coding test.
The lesson is clear:
In crypto, the biggest security threat may not always be a smart contract vulnerability. Sometimes, it is the person you trust.
#TraderTraitor #LazarusGroup #NorthKorea #CyberSecurity #CryptoSecurity #Bybit #Blockchain #CyberWarfare