Lazarus Group and TraderTraitor: North Korea’s Crypto Hackers Explained

Updated October 30, 2026.

The Lazarus Group is the name most people know for North Korea's state hackers, and it has become shorthand for the biggest crypto thefts ever. US agencies and security firms have tied North Korean units to the $620 million Ronin theft, the $1.5 billion Bybit hack and, according to TRM Labs, the roughly $6.36 billion drained from Binance on October 29, 2026.

But "Lazarus" isn't one gang. It's an umbrella over several units, and the one behind the biggest recent crypto heists has its own name in US government reports: TraderTraitor. Here's who they are, which heists have actually been pinned on them (only attributions made by named governments or firms), how they get in, why North Korea does it, and how to defend yourself.

Lazarus Group: the short version

• Who: A label researchers coined in 2016. Mandiant says it's used as an umbrella for several North Korean clusters, and that most North Korean hacking is run from the Reconnaissance General Bureau (RGB), the military intelligence agency.
• The crypto unit: TraderTraitor, as the FBI and CISA call it. Microsoft calls it Jade Sleet, Google's Mandiant UNC4899, and Palo Alto Networks' Unit 42 Slow Pisces.
• Biggest heists: Binance (about $6.36 billion, per TRM Labs), Bybit (about $1.5 billion, per the FBI), Ronin ($620 million, FBI) and DMM Bitcoin ($308 million, FBI and Japanese police).
• Totals: Chainalysis counted a record $2.02 billion stolen in 2025 and about $6.75 billion all-time.
• How they get in: fake recruiters, poisoned coding tests, fake investor calls, trusted suppliers, and North Koreans hired as remote IT workers.
• Why: UN experts and 11 governments say the money helps fund North Korea's weapons programs. Pyongyang denies it.

What is the Lazarus Group?

Where the name came from

In February 2016, a coalition of security firms led by Novetta published Operation Blockbuster, a study of the malware behind the November 2014 attack on Sony Pictures. Novetta called the actor "the Lazarus Group." Kaspersky, one of the partners, traced related activity back as far as 2009.

The FBI had already blamed the North Korean government for the Sony attack in December 2014. In February 2021, the US Justice Department charged three North Korean military intelligence officers, saying their units were known in the security world as "Lazarus Group" and "APT38." The charges covered Sony, the 2017 WannaCry ransomware, fake bank transfers and crypto thefts in a scheme to "steal and extort more than $1.3 billion of money and cryptocurrency."

Is the Lazarus Group one group?

No. Mandiant, now part of Google, wrote in 2022 that open-source reporting "often uses the Lazarus Group title as an umbrella term, referring to numerous clusters that we track separately." It assessed that most North Korean cyber operations, from espionage to financial crime, are run by elements within the RGB.

Vendors draw the lines a little differently, but these are the money-focused names you'll see:

Cluster	Other names	Known for
TraderTraitor	Jade Sleet, UNC4899, Slow Pisces	Exchange and bridge heists (DMM Bitcoin and Bybit per the FBI)
BlueNoroff	APT38, Sapphire Sleet, TA444 (per Kaspersky)	Bank heists, fake investor calls, fake job tests
Contagious Interview	Unit 42's campaign name	Malware disguised as interview coding projects
IT workers	Named in US Justice Department and FBI actions	Remote jobs under stolen or fake identities

The overlap is real: the 2022 US advisory that introduced TraderTraitor linked it to activity also tracked as Lazarus Group, APT38, BlueNoroff and Stardust Chollima.

What is TraderTraitor?

TraderTraitor first appeared in an April 2022 advisory from the FBI, CISA and the US Treasury. The name described fake crypto trading and price-prediction apps for Windows and macOS that hid malware. Staff at crypto firms, often in system administration or DevOps roles, got spear-phishing messages (personalized lures) dangling "high-paying jobs."

The label soon came to mean the unit itself. In July 2023, GitHub warned of "a low-volume social engineering campaign" by the group Microsoft calls Jade Sleet and CISA calls TraderTraitor, which lured developers into repositories with malicious npm packages (npm is the main library store for JavaScript). The FBI later named TraderTraitor for the DMM Bitcoin and Bybit thefts.

North Korea's biggest crypto hacks

These are the largest thefts publicly attributed to North Korean units by a government agency or a named firm. Flip the switch to see which ones the FBI itself has attributed.

Binance, October 2026 (about $6.36 billion). About $6.36 billion left Binance wallets across ten blockchains, most of it in about 20 minutes from 20:05 UTC, according to TRM Labs. TRM attributes it to TraderTraitor: "We make this judgment with high confidence." Binance hasn't named anyone, and no government had made an attribution as of October 30. Our full breakdown: how Binance was hacked.

Bybit, February 2025 (about $1.5 billion). Five days after the February 21 theft, the FBI named TraderTraitor. Safe{Wallet}, the wallet service Bybit used, said the attack came through "a compromised machine of a Safe{Wallet} developer," which put a disguised transaction in front of Bybit's signers.

Ronin, March 2022 ($620 million). The FBI said "Lazarus Group and APT38, cyber actors associated with the DPRK, are responsible" for draining the Axie Infinity game's bridge. The Block reported, citing two people familiar with the matter, that it began with a fake job offer sent to a senior engineer as a PDF.

DMM Bitcoin, May 2024 ($308 million). The FBI, the Pentagon's Cyber Crime Center and Japan's National Police Agency attributed the theft of 4,502.9 BTC to TraderTraitor. The way in was Ginco, a Japanese wallet software vendor, where someone posing as a LinkedIn recruiter approached an employee and sent what turned out to be a malicious coding test.

KelpDAO and Drift, April 2026 (about $577 million combined). Drift lost about $285 million on April 1 and KelpDAO about $292 million on April 18, according to TRM Labs. LayerZero, whose messaging system KelpDAO used, tied KelpDAO with preliminary confidence to TraderTraitor, as did TRM. TRM attributed Drift to a North Korean group it sees as distinct from TraderTraitor.

Harmony, June 2022 (about $100 million). The FBI attributed the Horizon bridge theft to Lazarus Group and APT38 and said more than $60 million was laundered through the Railgun privacy tool.

How much crypto has North Korea stolen?

Firms count incidents and prices differently, but the trend is clear:

Year	Stolen by North Korea-linked hackers	Source
2022	about $1.7 billion	Chainalysis
2023	$660.5 million in 20 attacks	Chainalysis
2024	$1.34 billion in 47 incidents	Chainalysis
2025	$2.02 billion, a record	Chainalysis
2026 so far	$643 million in the first half, then about $6.36 billion from Binance	TRM Labs

TRM puts North Korea's share of all crypto hack losses at 22% in 2022, 39% in 2024 and 64% in 2025, and 76% through April 2026, from just two attacks. Governments land in the same range: the Multilateral Sanctions Monitoring Team (MSMT), an 11-country group formed in October 2024 after the UN's expert panel on North Korea was disbanded, counted $1.2 billion in 2024 and at least $1.65 billion from January to September 2025. Chainalysis warns that even its record 2025 figure may show only the most visible part.

How North Korean hackers get in

Nearly every big North Korean heist on record started with a person, not a software bug. These are the lures as the FBI, CISA and security firms have described them publicly.

Fake recruiters and coding tests

A recruiter reaches out on LinkedIn, Telegram or Slack with a well-paid job at a crypto company. The FBI says these approaches are tailored after studying the target's social media. Then comes the "test." In the Contagious Interview campaign, which Unit 42 first documented in November 2023 and attributes to North Korea with moderate confidence, job seekers are asked to download and run a coding project that hides malware, often inside npm packages. The FBI lists a "pre-employment test" that uses unknown packages or repositories as a warning sign.

Fake investor calls and fake meeting apps

BlueNoroff poses as investors. Microsoft said in 2024 that Sapphire Sleet posed as venture capitalists; when the victim's screen froze on the call, the attacker sent a script to "fix the connection issue" that installed malware. Microsoft said the group stole over $10 million in six months. Kaspersky's October 2025 GhostCall report describes fake Zoom and Teams pages pushing a fake "update," aimed mostly at the Macs of tech and venture capital executives.

Trusted suppliers

When a target is well defended, they go through someone it trusts. Bybit was hit via Safe{Wallet}, DMM Bitcoin via its wallet vendor, and KelpDAO via infrastructure that LayerZero's verifier relied on, according to LayerZero.

Fake IT workers

North Koreans also get hired as remote developers under stolen or fake identities. In June 2025, the US Justice Department announced searches of 29 suspected "laptop farms" in 16 states, where US-based helpers hosted company laptops so the workers seemed local. It said more than 100 US companies had hired such workers, and that workers at one Atlanta blockchain firm allegedly stole over $900,000 in virtual currency. The FBI says some, once caught, hold stolen code "hostage" for ransom.

Think you'd spot these? Try it.

Why does North Korea hack crypto?

Sanctions cut North Korea off from most of the world's banks, but crypto can be stolen remotely and moved across borders in minutes.

The UN Panel of Experts said in March 2024 it was investigating 58 suspected North Korean cyberattacks on crypto companies between 2017 and 2023, worth about $3 billion. It cited one member state's estimate that cyber activity brings in about 50% of North Korea's foreign currency, and another's that 40% of its weapons of mass destruction programs are funded by illicit cyber means. Those are single-government estimates, not the panel's own findings.

In October 2025, the 11 MSMT governments said the activity helps fund North Korea's "unlawful weapons of mass destruction and ballistic missile programs." North Korea denies it; in May 2026 it dismissed theft reports as the work of "reptile media," The Block reported.

Where does the money go? After Bybit, the FBI said funds were spread across thousands of addresses on multiple blockchains and could be converted into regular currency. Freezes are the main counter-move: TRM says about $2.7 billion of the Binance haul, mostly stablecoins, was frozen within hours, but the attacker still holds roughly $2.4 billion.

How to protect yourself from the Lazarus Group

For companies

• Require independent approvals. The FBI recommends approvals from several unconnected networks before funds move. Bybit shows why each signer should verify the details on their own device.
• Keep keys offline. The FBI says seed phrases and private keys should stay off internet-connected devices.
• Lock down high-value machines. Allow only approved programs, limit access to code and build pipelines, and enforce multi-factor authentication, as CISA advises.
• Ban test code on work devices. If someone must run it, the FBI says use a virtual machine on a non-company device.
• Verify hires. The FBI recommends checking identity through hiring and employment, meeting in person where possible, and watching for sudden address or payment changes. Microsoft suggests asking remote staff to turn on their camera and explain code they supposedly wrote.
• Vet vendors. Bybit, DMM Bitcoin and KelpDAO were all reached through a supplier or shared infrastructure.

For developers and crypto holders

• Treat any unsolicited "clone this repo and run it" task as untrusted.
• Verify recruiters and investors through the company's official site or a separate channel.
• Be wary when someone pushes you to switch messaging apps or install special software for a call. The FBI lists both as warning signs.
• Never run a "fix" script because a meeting won't connect.
• Keep your seed phrase offline and never type it into a website.

Lazarus Group FAQ

What is the Lazarus Group?

The Lazarus Group is the best-known name for North Korean state hackers. Researchers coined it in 2016 while studying the 2014 Sony Pictures attack. Today it's an umbrella: Mandiant says it covers several separate clusters, mostly run from North Korea's Reconnaissance General Bureau, behind espionage, destructive attacks and record crypto thefts.

Is the Lazarus Group North Korean?

Yes, according to the US and allied governments. The FBI blamed North Korea's government for the 2014 Sony attack, and a 2021 US indictment described Lazarus Group and APT38 as North Korean military hacking units. Eleven MSMT governments tie the thefts to North Korea's weapons programs. North Korea denies involvement.

What is TraderTraitor?

TraderTraitor is the US government's name for the North Korean unit behind many of the biggest recent crypto heists. It was first named in a 2022 FBI, CISA and Treasury advisory about fake crypto trading apps. Microsoft calls it Jade Sleet, Mandiant UNC4899 and Unit 42 Slow Pisces. The FBI tied it to DMM Bitcoin and Bybit.

What are the biggest Lazarus Group hacks?

By value: Binance (about $6.36 billion in October 2026, per TRM Labs), Bybit (about $1.5 billion in 2025, per the FBI), Ronin ($620 million in 2022, per the FBI) and DMM Bitcoin ($308 million in 2024, per the FBI and Japanese police). KelpDAO and Drift lost about $577 million combined in April 2026.

How much crypto has North Korea stolen?

Chainalysis estimates about $6.75 billion through 2025, including a record $2.02 billion in 2025, and calls that a lower bound. TRM Labs counted $643 million in the first half of 2026, before the roughly $6.36 billion Binance theft in October, which alone tops any previous full year.

Why does North Korea steal crypto?

Sanctions block most of its normal sources of foreign money, and crypto can be stolen remotely and moved fast. A 2024 UN expert report cited one member state's estimate that 40% of North Korea's weapons of mass destruction programs are funded by illicit cyber means. Eleven governments say the thefts help pay for weapons and missiles.

What are North Korean IT workers?

North Koreans hired as remote developers under stolen or fake identities, who send their pay back to the regime. US-based helpers run "laptop farms" so they look local. The US Justice Department says more than 100 US companies hired such workers, and the FBI says some steal code and extort employers once discovered.

Want the latest attributions as they land? Ask Cleus, the uncensored AI that searches live sources, about any heist or group in this article.

Sources

• CISA, FBI, Treasury: TraderTraitor advisory AA22-108A
• FBI: Bybit PSA
• FBI: Social engineering against the crypto industry
• FBI: North Korean IT workers and data extortion
• US Justice Department: Actions against North Korean remote IT workers
• TRM Labs: Binance theft attribution
• TRM Labs: North Korea's 2026 share of hack losses
• Chainalysis: 2025 stolen funds review
• Mandiant: Mapping DPRK groups to government
• Microsoft: CYBERWARCON threat intelligence
• Kaspersky: Operation Blockbuster
• Kaspersky: GhostCall and GhostHire
• Unit 42: Campaigns targeting job hunters
• UK government: MSMT joint statement
• The Star (AFP): MSMT report figures
• The Korea Times: UN panel report
• The Record: FBI on DMM Bitcoin
• The Record: GitHub and Jade Sleet
• BleepingComputer: FBI on Ronin
• BleepingComputer: 2021 indictment
• The Block: FBI on Harmony
• The Block: Ronin's fake job offer
• The Block: LayerZero on KelpDAO
• The Block: North Korea's denial
• Korea JoongAng Daily: $643 million in the first half of 2026
• Wiz: TraderTraitor deep dive
• The Hacker News: Bybit and Safe{Wallet}
• CBS News: FBI on Sony Pictures
• Cleus: How Binance was hacked