What is TraderTraitor, the hacking squad behind the $6.3 billion Binance heist

The theft was the largest in crypto history, more than four times the $1.5 billion stolen from Bybit in February 2025, an attack the FBI also blamed on TraderTraitor. The Binance theft roughly doubled in one swoop the more than $6 billion TRM Labs estimated in April that North Korean hackers had stolen since 2017.

TraderTraitor's attacks have repeatedly begun with recruitment pitches or compromises of trusted software suppliers, according to FBI findings and Bybit's investigation. Those breaches gave its hackers access to the systems used to approve transfers.

Sophisticated Social Engineering

The group bypasses security through sophisticated social engineering, such as fake job interviews and recruiters targeting crypto employees with malware. At Binance, a software engineer was contacted in September by someone posing as a project director.

A purported human resources representative interviewed the engineer and shared a social media account with personal photos to build trust. A second interview, with a supposed CEO, ended with instructions to download a coding assignment onto the engineer's work computer.

North Korean Origins

TraderTraitor's origins go back to a specialist crypto-theft team formed in 2016-2017 by North Korea's foreign intelligence agency, the Reconnaissance General Bureau. An October 2025 report places TraderTraitor within the bureau's 110 Research Institute.

To get into the team, talent is developed from childhood. Talented children are placed in specialized STEM schools, given internet access, and sent to China to develop their abilities.

The group operates internationally, with McLouth noting they're 'operating in dozens of countries internationally, and that they are starting to become decentralized.'

Following the Money

Chainalysis said its strongest evidence was stolen Binance funds being combined with proceeds from September's roughly $388 million Bitget hack, which had been attributed to North Korea. Pyongyang denies involvement.

Kim Yo Jong, the sister of leader Kim Jong Un, dismissed the FBI's finding as 'absurd rhetoric' in a statement. The group's objective goes beyond taking funds - it's about getting these funds laundered and having it in a usable format.

In previous operations, over-the-counter traders have converted crypto into fiat currencies that the North Korean government can then use. These are often trading entities operating in jurisdictions with little to no regulatory oversight.

McLouth emphasized that 'Security can't begin when the funds move. The intrusion before the theft needs to be studied as closely as the laundering afterward.'