E-Paper
Fake job offers & hijacked approvals: Methods of TraderTraitor, suspected group behind Binance theft
North Korean unit is believed to be part of Lazarus Group. Analysts link it to the $6.3 billion Binance theft. FBI had blamed it for the 2025 Bybit theft.
Prefer HTon Google
North Korea’s TraderTraitor hacking unit, which blockchain analysts suspect was behind the theft of about $6.3 billion from Binance, has a record of breaking into crypto companies through their employees and then taking over the systems that approve payments.
Binance, the world’s biggest cryptocurrency exchange, said hackers had taken about $6.3 billion from its wallets, in what is estimated to be the largest crypto theft on record. Most of it was taken in about 20 minutes, starting shortly after 2000 GMT on Thursday, or about 1.30am IST on Friday, Reuters reported.
TRM Labs, a US blockchain intelligence firm, attributes the attack to TraderTraitor. “We make this judgment with high confidence,” it said in a post on its website. Jonathan Levin, chief executive of the analytics firm Chainalysis, wrote on X that the theft was “likely done by DPRK group TraderTraitor”, using North Korea’s official initials. Elliptic, a British analytics firm, also pointed to North Korea.
The FBI named North Korea and TraderTraitor as responsible for the theft of about $1.5 billion from Bybit, another exchange, in February 2025, the previous record.
The US government has not yet attributed the Binance theft. But the FBI said it was aware of the incident and was working with public and private partners. Asked whether North Korea was involved, US President Donald Trump told reporters at the White House: “We’re looking at that.”
North Korea routinely denies involvement in cyberattacks and cryptocurrency thefts, and its mission in Geneva and embassy in China did not immediately respond to requests for comment.
About TraderTraitor
The US government used the name TraderTraitor in April 2022, for a set of fake cryptocurrency apps that posed as trading tools and infected the computers of people who installed them. By the time of the Bybit theft, the FBI was using the name for the North Korean hackers behind such attacks.
Security companies track the same group under other names, including Lazarus Group, according to the 2022 advisory by the FBI, the US Treasury and CISA, the US cybersecurity agency. Japan’s National Police Agency says TraderTraitor is believed to be part of Lazarus Group, which it says is believed to work under the North Korean authorities.
ALSO READ: Bitcoin slides below $77,000 as record $6.3B Binance hack rattles crypto
The US Treasury, which put Lazarus under sanctions in 2019, says the group is controlled by the Reconnaissance General Bureau, North Korea’s main intelligence agency, and was created by the government as early as 2007. A Lazarus offshoot, Bluenoroff, was formed to raise money illegally as international sanctions tightened, partly for the country’s nuclear weapons and ballistic missile programmes, the Treasury says.
Experts say North Korea turned to crypto theft for badly needed foreign currency to support its economy and fund its nuclear programme after tough United Nations sanctions, AP reported.
Workings and operations
According to the 2022 advisory, TraderTraitor’s intrusions begin with large numbers of targeted messages to staff at crypto companies, often system administrators and DevOps engineers, the people who build and run a company’s software. The messages often pose as offers of well-paid jobs and ask the recipient to download an app laced with malware.
Once inside, the hackers spread through the company’s network and look for private keys, the secret codes that authorise spending from a crypto wallet, or for other gaps that let them start fraudulent transfers. The advisory says they have at times finished within a week of getting in.
A 2024 FBI warning provided more detail. North Korean teams pick a company, study its employees on social media and job sites, and try to deceive dozens of them, it says. They build a story around each target, often a job or investment offer, and keep up long conversations to win trust. Among the warning signs, the FBI lists a request to take a coding test for a job by running unfamiliar code.
Japan’s National Police Agency described the method in December 2024 after investigating the theft of crypto worth about ¥48.2 billion from DMM Bitcoin, a Japanese exchange. The FBI, which worked on the case with Japanese police, put the loss at $308 million.
The agency listed examples of the methods its investigation had uncovered. They approach employees on social media, sometimes posing as company executives with other people’s names and photos, and open with questions drawn from the target’s profile, such as asking a software engineer for help fixing a bug. They may then ask the target to run a small program posted on GitHub, a site where developers share code. The program can contact a server the attackers control, and code hidden in the reply can infect the computer.
From there, the attackers may steal passwords and session cookies, the small files that keep a user logged in, and use them to pose as the employee. The agency warned that they may quickly map the company’s systems to find where that employee’s access would let them take crypto.
At Bybit, the attackers came in through an outside supplier. Bybit said its forensic review found that the credentials of a developer at its outside wallet-software provider had been compromised. That gave the attackers access to the provider’s systems and let them deceive the Bybit staff who sign off on transfers into approving a malicious transaction, Bybit said.
At Binance
Binance said its initial investigation suggested a compromised laptop belonging to a DevOps engineer, AFP reported, but that a later investigation found “additional points of breach”. It said it had found no evidence that the private keys to its wallets had leaked.
Richard Teng, Binance’s co-chief executive, said the attackers manipulated a system used to approve transactions, moving money out of a hot wallet, one connected to the internet, without passing through normal approval controls. He said the attack also involved malicious software designed to delete evidence of its activity as it went along.
TRM says the attackers began preparing at least 36 hours before the theft. On the morning of October 28, they started putting small sums into a crypto wallet they used to run the operation. The three payments came through Tornado Cash, a service that hides where crypto comes from. Early on October 29, they tested their program on two wallets. Later that day they held a full rehearsal on a third wallet and sent the test money back to themselves. Four hours after the rehearsal, they used the same program on a Binance wallet.
That Binance wallet was on Ethereum, a blockchain network whose own currency is called ether. A blockchain is a public record of transactions kept on many computers at once. Ethereum also lets users run small programs on the network that can move money when given instructions.
Since an upgrade in May 2025, an ordinary Ethereum wallet can hand control of itself to one of these programs by signing a permission, according to TRM. The arrangement stays in place until the wallet signs a new one. The attackers obtained permissions, signed by the Binance wallet, that handed it to a program only they could command.
Each permission works only if it matches the wallet’s running count of transactions at that moment. The Binance wallet’s count kept rising as it paid out customer withdrawals. The attackers had prepared 50 permissions in advance, one for each of 50 consecutive counts, and one of them matched. About three minutes later, they told the wallet to send them its entire balance. They kept sweeping new deposits out of it for more than three hours.
On the same night, Binance wallets on nine other blockchains, including bitcoin’s, sent money to the attackers through ordinary transfers. Those networks use different kinds of keys and different ways of signing. Since all of them paid out, TRM’s assessment is that the attackers had most likely found a way to make Binance’s signing system approve transfers of their choosing.
“In layman’s terms, the attacker may not have stolen the vault key, they may have hijacked the system that tells the vault to release money,” Joshua Chu, a Hong Kong lawyer who works on crypto cases, told Reuters.
Does it fit the pattern?
Several details of the Binance theft match what governments have described before. Binance says the first compromised laptop belonged to a DevOps engineer, the kind of employee the 2022 advisory said the group targets. How that laptop was compromised has not been disclosed.
At DMM Bitcoin and Bybit, and by Binance’s and TRM’s account at Binance, the attackers may have taken money by using stolen access to the systems and people that approve transfers. Japanese authorities had warned in their advisory that logs can be erased after an infection. Teng said the malware at Binance deleted evidence as it ran.
“Several features of this attack match earlier North Korea-linked heists,” TRM said. The firm lists them as small payments through Tornado Cash into the wallet the attackers worked from, preparation well before the theft, and permissions signed in advance and used all at once.
TRM put the Binance theft at about four times the size of Bybit’s. It also said the laundering differed: the attackers have relied on large swaps with market makers and lending platforms, where after Bybit they moved funds heavily across blockchains.
Chainalysis said: “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence,” Reuters reported. Chainalysis also said funds stolen last month from Bitget, another exchange, were being mixed with the Binance proceeds.
The money trail
Binance says about $3 billion of the stolen assets has been frozen. Much of that is in stablecoins, digital tokens pegged to the US dollar, which their issuers can freeze remotely. Tether froze nearly $1.57 billion and Circle more than $800 million, Reuters reported.
TRM estimates that about $2.4 billion in bitcoin and ether is beyond reach. “The bitcoin and ether can be stopped only if the attacker sends them to a crypto-asset exchange or broker that is able and willing to freeze them, or if law enforcement obtains the private keys,” Patrick Tan, general counsel of the Singapore blockchain intelligence firm ChainArgos, told Reuters.
Binance has pledged to cover all customer losses from its own funds and has set aside about $6.34 billion to do so. It has also promised a detailed technical analysis once its investigation is complete.
