TraderTraitor is a North Korea-aligned threat group that steals cryptocurrency. It is also tracked as Jade Sleet, UNC4899 and Pukchong. The post describes it as part of the larger Lazarus Group. It targets crypto exchanges, developers and blockchain software providers. It often does so through fake recruiter messages and trojanized developer tools. The post says the stolen money is meant to fund the North Korean state.
Latest Activity: Binance Incident, October 2026
On 29 October 2026, Binance paused withdrawals after an incident it puts at about $6.3 billion. TRM Labs said with “high confidence” that TraderTraitor was likely behind it, and Chainalysis CEO Jonathan Levin gave a similar view. Binance has not named an attacker. Our Binance security incident analysis shows how the funds moved and what is still not known. A study of Telegram and X posts after the hack shows when the TraderTraitor name reached underground channels.
Introduction
TraderTraitor, also known as Jade Sleet, UNC4899, and Pukchong, is a North Korea-aligned threat group. It has become one of the most prolific financial cyber actors in the world. It is part of the larger Lazarus Group. TraderTraitor focuses on cryptocurrency theft, blockchain exploitation, and software supply-chain breaches. Its campaigns mix espionage tactics with cybercrime for money. The aim is to support North Korea’s sanctioned economy.
Since at least 2020, according to CISA, the group has moved from simple phishing attacks to more complex operations. These include trojanized developer tools, fake cryptocurrency platforms, and malware that targets both Windows and macOS systems. Its constant innovation has helped it steal billions of dollars in cryptocurrency. The victims are exchanges, blockchain developers, and fintech firms around the world.
Who Is TraderTraitor and What Motivates It?
TraderTraitor is linked to the Democratic People’s Republic of Korea (DPRK). It shares operational ties with the notorious Lazarus Group. This larger group includes subclusters like APT38 and Andariel. Unlike the espionage-focused branches of Lazarus, TraderTraitor mainly aims for financial gain. Its actions directly raise funds for the DPRK regime. The money supports nuclear weapons programs, helps evade international sanctions, and keeps state operations running.
The group’s names Jade Sleet, UNC4899, and Pukchong refer to overlapping activity. This activity keeps targeting cryptocurrency developers, exchanges, and blockchain software providers. It shows a clear focus on the digital finance space.
- Aliases.
- Jade Sleet, UNC4899, Pukchong.
- Alignment.
- North Korea-aligned, part of the larger Lazarus Group.
- First seen.
- At least 2020.
- Motivation.
- Financial gain that funds the DPRK regime.
- Targets.
- Crypto exchanges, developers and blockchain software providers.
- Common entry.
- Spear-phishing and fake recruiter or investor messages.
What Tactics, Techniques and Procedures Does TraderTraitor Use?
TraderTraitor has a set approach that blends social engineering, supply-chain compromise, and custom malware. The group is known for breaking into trusted development environments. They often reach victims indirectly through third-party dependencies or tainted software packages.
Initial Access: The group mainly uses spear-phishing and social engineering. Its operators pretend to be recruiters or investors from real cryptocurrency firms. They reach out via LinkedIn, Telegram, and email. They lure victims into downloading malicious attachments or fake job-related applications with backdoors. In some cases, TraderTraitor compromises open-source repositories or development tools. This spreads trojanized software libraries.
Persistence: After gaining access, TraderTraitor stays in for the long term. It uses modified update processes, persistent registry entries, and hidden malicious code inside legitimate applications. On macOS systems, the group has been seen using signed binaries to avoid detection. It takes advantage of developer certificates and Apple’s notarization process.
Command and Control (C2): The group uses HTTPS-based encrypted communication. It sends stolen data to servers controlled by DPRK or to compromised servers. Its infrastructure often mimics real blockchain or developer platforms. This makes detection difficult.
Malware and Tools:
– AppleJeus: A malware family disguised as cryptocurrency wallet software. It is built to steal credentials, private keys, and funds from infected systems.
– Custom Loaders: These deliver secondary payloads, such as remote access trojans (RATs) and data stealers.
– Trojanized Developer Tools: Compromised npm, PyPI, and GitHub repositories have spread malicious code to unsuspecting developers.
– Fake Wallet Apps: These are found on macOS, Windows, and Linux systems. They trick users into sending funds to DPRK-controlled wallets.
Techniques: The group mixes credential harvesting, data exfiltration, code signing abuse, and cryptocurrency wallet compromise. It also shows growing skill in exploiting the software supply chain. State-sponsored spies often dominate this area.
Notable Operations
AppleJeus Campaigns (2020–2021): These operations marked TraderTraitor’s early step into cross-platform targeting. The group created fake cryptocurrency trading apps. It spread them through phishing campaigns and sites pretending to be real exchanges. Once installed, the malware stole private keys and credentials. This allowed theft of cryptocurrency directly from wallets.
Supply-Chain Compromises (2022): In 2022, TraderTraitor took advantage of software supply chains by inserting bad code into open-source repositories. These tainted updates hit developers in fintech and blockchain. This let the group move from compromised development environments to high-value targets.
Social Engineering Surge (2023): Using professional networking platforms, the group pretended to be recruiters from well-known crypto firms and offered fake interviews. Victims were tricked into downloading infected applications. This gave TraderTraitor remote access to their systems.
ByBit and Blockchain Exploitation (2024–2025): The FBI attributes the theft of about $1.5 billion in virtual assets from the ByBit exchange in February 2025 to North Korea. It says TraderTraitor actors moved the stolen assets across thousands of addresses on multiple blockchains.
- 2020 to 2021AppleJeus campaignsFake crypto trading apps stole private keys and credentials.
- 2022Supply-chain compromisesBad code inserted into open-source repositories.
- 2023Social engineering surgeFake recruiters offered interviews that led to infected applications.
- 2025ByBit exchange hackThe FBI attributes the theft of about $1.5 billion to North Korea.
Strategic Impact and Defensive Takeaways
TraderTraitor’s operations highlight the link between state strategy and organized financial cybercrime. The DPRK uses cyber efforts in a systematic way for economic gain. This blurs the line between spying and stealing. Each successful campaign directly supports North Korea’s larger geopolitical goals.
For defenders, TraderTraitor stresses the need to secure development environments. It also stresses verifying code integrity and enforcing strict access controls across blockchain infrastructure. Key defensive recommendations include:
– Enforce multifactor authentication for all developer and exchange accounts.
– Validate code signatures. Use software bill of materials (SBOM) practices to find unauthorized dependencies.
– Hunt regularly for signs of AppleJeus, UNC4899 infrastructure, and fake recruiter campaigns.
– Watch for unusual outbound connections to domains that mimic blockchain APIs or fintech platforms.
- Enforce multifactor authenticationFor all developer and exchange accounts.
- Validate code signaturesUse SBOM practices to find unauthorized dependencies.
- Hunt for known signsAppleJeus, UNC4899 infrastructure and fake recruiter campaigns.
- Monitor outbound connectionsWatch for domains that mimic blockchain APIs or fintech platforms.
Conclusion
TraderTraitor ranks as one of the most successful financially motivated threats in history. It combines espionage-level skills with a constant drive for money. As of 2025, the group remains dynamic. It uses social engineering, supply-chain infiltration, and advanced malware to exploit the digital financial ecosystem.
Its persistence and adaptation show how cybercrime, state policy, and economic need meet in today’s threat landscape. Billions have been stolen and many organizations compromised. TraderTraitor is both a warning and a benchmark for what state-supported financial cyber operations can do.
You can download and review the sheet for all the details!
