Binance 6.3 billion USD hacker identified as TraderTraitor, what is the relationship with Lazarus?
*Author: [Rhythm BlockBeats](https://www.theblockbeats.info/news/64036)*
On November 1, the FBI issued a notice attributing the $6.3 billion stolen from Binance on October 29 to North Korea. The notice used a term: TraderTraitor.
If you search for this name, you will find connections to Bybit's $1.5 billion, Bitget's $300 million, and several major cryptocurrency cases from previous years.
TraderTraitor is not a company, nor is it a box on an organizational chart. It is a code name given by the U.S. government for a type of behavior.
In April 2022, the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), and the U.S. Department of the Treasury jointly issued a notice numbered AA22-108A. This was the first official appearance of the term. At that time, it referred to several Trojan horses disguised as cryptocurrency trading software, such as DAFOM, TokenAIS, and CryptAIS, which had interfaces that looked legitimate and began stealing private keys once installed.
The individuals behind these actions have long been referred to in the industry as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima; these are not four separate teams. Lazarus, also known as Lazarus, is a collective name; APT38 (Mandiant), BlueNoroff (Kaspersky), and Stardust Chollima (CrowdStrike) are three names given by different security companies to the same group involved in financial crimes.
Two years later, this label was applied to specific actions. On December 23, 2024, the FBI, the U.S. Department of Defense Cyber Crime Center, and the National Police Agency of Japan jointly released an attribution for the $300 million theft from DMM, using the phrase "North Korean cyber actors tracked as TraderTraitor" for the first time, listing three of its aliases: Jade Sleet (Microsoft's term), UNC4899 (Google's term), and Slow Pisces (Palo Alto's term).
Now the information is clearer; TraderTraitor is a part of the larger Lazarus group, specifically focused on cryptocurrency assets, and is currently the most profitable. It has been targeting blockchain since at least 2020—trading platforms, DeFi, wallet service providers, cryptocurrency funds, and individuals holding large amounts of coins.
### From Bank Robberies to Trading Platform Heists
Lazarus is an umbrella name that encompasses a wide range of activities, including deleting Sony Pictures' hard drives in 2014 and transferring money from the Bangladesh central bank in 2016.
For example, in the case of the Bangladesh central bank, the attackers were known as APT38, also called BlueNoroff. In February 2016, they forged SWIFT instructions (the international messaging system used for bank transfers) to attempt to transfer $1 billion from the Bangladesh central bank's account at the New York Federal Reserve. Ultimately, they managed to transfer $81 million due to a spelling error in one of the transfers, which was intercepted by an intermediary bank.
The skills developed in studying banking operations, finding gaps in manual reviews, and forging instructions were later directly applied to cryptocurrency trading platforms.
Around 2020, they began to upgrade their methods, targeting the cryptocurrency sector. The reasons are easy to guess: there is money, little regulation, and decent liquidity.
There are several methods they use.
The first is fake recruitment. Recruiters find you on LinkedIn, have a good conversation, and then send you a "pre-employment programming test" or an "internal tool" installation package. Once installed, the machine is theirs. The $620 million from Ronin was lost this way.
The second is supply chain attacks. They stop deceiving and instead pollute developers' toolchains: malicious repositories on GitHub, poisoned packages on npm, identity service providers like JumpCloud. If one person gets compromised, a whole chain of downstream companies follows.
The third is directly altering transactions. In the DMM case, they stole the login credentials of the other party, infiltrated the internal communications of the wallet company Ginco, and altered a transaction that should have been normal. In the Bybit case, they hacked into a developer's computer at Safe{Wallet}, injected a script into the web front end, so that the signer saw a normal page, but what they signed was something else.
This also includes the recent Binance incident.
The attackers prepared 36 hours in advance, signing 50 EIP-7702 authorizations, which is a new Ethereum feature allowing wallets to temporarily "rent" a program for use, and then made Binance's hot wallet transfer the funds itself; it took 40 minutes and crossed 10 networks. Security companies concluded that they likely had already accessed Binance's signing system.
### Amounts Involved in This Organization's Crimes
The twelve most famous cases amount to $9.7 billion.
Binance alone accounts for $6.3 billion. The remaining eleven cases, from 2022 to 2026, total $3.44 billion.
Bybit's $1.5 billion was due to a compromised front end; Ronin's $620 million was lost through a fraudulent recruitment scheme; Bitget's $388 million was due to forged withdrawal instructions written into the wallet system.
DMM $308 million, WazirX $235 million, Harmony and Atomic each $100 million, Alphapo $60 million, CoinEx $55 million, Stake $41 million, CoinsPaid $37 million.
In the chart, only Binance, Bybit, and DMM were directly named TraderTraitor by the U.S. government. Ronin, Harmony, Stake, Alphapo, CoinsPaid, and Atomic were attributed by the FBI to Lazarus/APT38; WazirX was named in a joint statement by the U.S., Japan, and South Korea in January 2025; CoinEx was only inferred by on-chain analysis firms. The Bitget incident is suspected by multiple institutions to be related to TraderTraitor, but no formal attribution has been made.
According to TRM, North Korea has conducted 100 attacks since 2017, accumulating about $12.8 billion; this year alone, $7.4 billion; by 2026, 85% of the total amount of stolen global cryptocurrency assets will be attributed to North Korea. This table only represents twelve of those cases.
### Identifiable Individuals
There are more than one North Korean hacker named by U.S. officials, and they have left behind photos. Park Jin Hyok, Jon Chang Hyok, and Kim Il were mentioned in the February 2021 indictment; in 2024, Rim Jong Hyok was added, with a reward of $10 million.
*FBI wanted poster for Park Jin Hyok*
Park Jin Hyok is one of the earliest to be indicted: in June 2018, the U.S. Department of Justice filed criminal charges against him, which were unsealed in September of the same year. The indictment states that his conspiracies include the 2014 Sony Pictures attack, the 2017 WannaCry, and the $81 million transferred from the Bangladesh central bank. He has been on the run and has never appeared in court.
### Tracking the Binance Theft
Binance has used company funds, the SAFU fund, and the futures insurance fund to cover about 90% of the losses; the remaining 10% consists of illiquid tokens; all losses are borne by the company, not by users.
As of November 1, approximately $2.7 billion, about 42%, has been frozen by stablecoin issuers and the Arbitrum security committee. The attackers still hold 420,000 Ethereum and 18,270 Bitcoin, worth about $2.4 billion.
The money laundering methods are still conventional: cross-chain bridges for swapping chains, services like THORChain for exchanging currencies, and mixers that blend many people's coins together before moving them to over-the-counter transactions.
This time there were some small incidents; THORChain recently delayed the money laundering process for the stolen funds from the Binance attack due to an unexpected Ethereum chain reorganization. This chain reorganization led THORChain to mistakenly refund a user who deposited 10 ETH multiple times, triggering an emergency pause in the protocol, temporarily preventing all users from conducting cross-chain exchanges, including those related to North Korean hacker organizations.
Last time, the stolen funds from Bitget passed through THORChain, which did not freeze anything, claiming decentralization cannot freeze, but when it was hacked, it did not say the same.
When THORChain resumes service, if the stolen funds from this Binance incident also pass through THORChain, it will be interesting to see what excuse they come up with to deflect.