Binance's $6.3 billion hack traced to TraderTraitor, what's the connection to Lazarus?

On November 1, the U.S. Federal Bureau of Investigation issued an advisory attributing the $6.3 billion stolen from Binance on October 29 to North Korea. The advisory used a term: TraderTraitor.

If you search this name, you will find that Bybit's $1.5 billion, Bitget's $300 million, and several major cryptocurrency cases in previous years are all connected to this name.

TraderTraitor is not a company, nor a box on an organizational chart. It is a codename the U.S. government gave to a category of behavior.

In April 2022, the FBI, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Department of the Treasury jointly issued an advisory, numbered AA22-108A. That was the first official appearance of this term. At the time, it referred to several trojans disguised as cryptocurrency trading software, such as DAFOM, TokenAIS, and CryptAIS, with interfaces that looked convincing and began stealing private keys once installed.

The people behind this have long been called Lazarus Group, APT38, BlueNoroff, and Stardust Chollima in the industry. These are not four separate teams. Lazarus is the umbrella name; APT38 (Mandiant), BlueNoroff (Kaspersky), and Stardust Chollima (CrowdStrike) are three names different security companies gave to the same money-making operation.

Two years later, the label was attached to specific behavior. On December 23, 2024, the FBI, the U.S. Department of Defense Cyber Crime Center, and the Japanese National Police Agency jointly released the attribution for the $300 million DMM theft case, using for the first time the phrasing "North Korean cyber actors tracked as TraderTraitor" and listing its three aliases: Jade Sleet (Microsoft's name), UNC4899 (Google's name), and Slow Pisces (Palo Alto's name).

The information is now relatively clear: TraderTraitor is the unit within the larger Lazarus group that specializes in crypto assets and is currently the most lucrative. Since at least 2020, it has focused exclusively on blockchain—trading platforms, DeFi, wallet service providers, crypto funds, and individuals holding large amounts of coins.

From robbing banks to robbing trading platforms

Lazarus is an umbrella name covering everything, from wiping Sony Pictures' hard drives in 2014 to transferring money out of the Bangladesh central bank in 2016.

For instance, in the Bangladesh central bank case, the perpetrators were known as APT38, also called BlueNoroff. In February 2016, they forged SWIFT instructions (the international messaging system used for interbank transfers) in an attempt to transfer $1 billion from the Bangladesh central bank's account at the New York Fed. They ultimately succeeded in taking $81 million, as a spelling error in one transfer caused an intermediary bank to block it.

The techniques of studying bank operational processes, finding gaps in manual review, and forging instructions were later transplanted verbatim to cryptocurrency trading platforms.

Around 2020. They began upgrading their methods, targeting the crypto space. The reasons are easy to guess: money without regulation, and decent liquidity.

There are several types of attack methods.

The first is fake recruitment. Headhunters contact you on LinkedIn, have a pleasant chat, and finally send a "pre-employment coding test" or an installer for an "internal tool." Once installed, the machine is theirs. The $620 million from Ronin was lost this way.

The second is supply chain. Instead of deceiving people, they contaminate developers' toolchains: malicious repositories on GitHub, poisoned packages on npm, identity service providers like JumpCloud. One person falls victim, and a string of downstream companies follow.

The third is directly altering transactions. In the Japanese DMM case, they stole the other party's login credentials, infiltrated the internal communications of the wallet company Ginco, and then altered a transfer that should have been normal. In the Bybit case, they hacked into a developer's computer at Safe{Wallet}, inserted a script into the web frontend, so that the signer still saw a normal page, but what was signed was a different transaction.

This also includes the Binance incident this time.

The attackers prepared 36 hours in advance, signed 50 EIP-7702 authorizations—a new Ethereum feature that allows a wallet to temporarily "rent" a program for use—and then had Binance's hot wallet transfer the funds out itself; in 40 minutes, across 10 networks. A security firm's conclusion is: they very likely had already breached Binance's signing system.

The amount involved in this organization's crimes

The twelve most famous cases, $9.7 billion.

Binance alone accounts for $6.3 billion. The remaining eleven cases, from 2022 to 2026, add up to $3.44 billion in total.

Bybit $1.5 billion, was the altered frontend; Ronin $620 million, was the fraudulent recruitment; Bitget $388 million, was the forged withdrawal instructions written into the wallet system.

DMM $308 million, WazirX $235 million, Harmony and Atomic $100 million each, Alphapo $60 million, CoinEx $55 million, Stake $41 million, CoinsPaid $37 million.

In the chart, only Binance, Bybit, and DMM were directly named TraderTraitor by the U.S. government. Ronin, Harmony, Stake, Alphapo, CoinsPaid, and Atomic were attributed by the FBI to Lazarus/APT38; WazirX was named in a joint statement by the U.S., Japan, and South Korea in January 2025; CoinEx was only inferred by on-chain analysis firms. The Bitget case was suspected by multiple institutions to be related to TraderTraitor, but none made a formal attribution.

According to TRM statistics, North Korea has carried out one hundred cases since 2017, totaling approximately $12.8 billion; $7.4 billion year-to-date; of the total global crypto asset theft in 2026, 85% is attributed to North Korea. This table is just twelve of them.

People Who Can Be Identified

There is more than one North Korean hacker who has been named by U.S. officials and whose photos have been released. Park Jin Hyok, Jon Chang Hyok, and Kim Il were all in the February 2021 indictment; in 2024, Rim Jong Hyok was added, with a $10 million reward.

Park Jin Hyok, wanted by the FBI

Park Jin Hyok was one of the first to be indicted: in June 2018, the U.S. Department of Justice filed criminal charges against him, and the indictment was unsealed in September of the same year. The indictment said his involvement in the conspiracy included the 2014 Sony Pictures attack, the 2017 WannaCry, and the $81 million transferred from the Bangladesh central bank in 2016. He remains at large and has never appeared in court.

Binance Hack Tracking

Binance has covered about 90% using corporate funds, the SAFU fund, and the futures insurance fund, with the remaining 10% in illiquid tokens; all losses are borne by the company, not by users.

As of November 1, approximately $2.7 billion, or about 42%, has been frozen by stablecoin issuers and the Arbitrum Security Council. The attackers still hold 420,000 ETH and 18,270 BTC, worth about $2.4 billion.

The money laundering playbook is still the usual: cross-chain bridges to switch chains, services like THORChain to swap coins, mixers to pool and scatter many people's coins together, and finally off-exchange trading.

There were some hiccups this time. THORChain recently accidentally delayed the money laundering process of the stolen funds from the Binance attack due to an Ethereum chain reorganization. This chain reorganization caused THORChain to erroneously issue a duplicate refund to a user who deposited 10 ETH, which in turn triggered an emergency pause of the protocol, temporarily preventing all users from conducting cross-chain swaps, including money launderers associated with North Korean hacker groups.

Last time, the stolen funds from Bitget passed through THORChain, and THORChain did not freeze them at all, saying that decentralization means they cannot be frozen—but that is not what they said when they themselves were hacked last time.
When THORChain resumes service, if the stolen Binance funds this time still pass through THORChain, it is unclear what excuse they will have to fob us off with.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia