When $6.3 billion vanished from Binance’s wallets in about 20 minutes, blockchain analysts quickly pointed to one name: TraderTraitor.
Cybersecurity researchers and blockchain intelligence firms use TraderTraitor to refer to a North Korean state-sponsored hacking unit.
It is widely considered part of the Lazarus Group, the broader umbrella name for Pyongyang’s cyber warfare apparatus, which has been linked to attacks since around 2009, including the 2014 Sony Pictures hack and the 2016 Bangladesh Bank heist.
The name “TraderTraitor” comes from a malware family that disguised itself as legitimate cryptocurrency trading software to lure industry professionals. According to TRM Labs, the unit is “North Korea’s elite hacking unit,” and the firm attributed the Binance attack to it “with high confidence,” citing “robust on- and off-chain intelligence.”
Chainalysis and Singapore-based Pangolin intelligence reached similar conclusions.
Its fingerprints were easy to detect. According to TRM, there were three similarities between the Binance hack and other cybercrimes carried out by North Korea, including the Bybit hack, involving a $1.5 billion theft in February 2025 and the KelpDAO hack, which took place in April 2026: small withdrawals from Tornado Cash; the preparation, which was done well ahead of the crime; and signatures collected in advance and executed all at once.
According to experts, this unit works as a means of generating income for the sanctions-hit regime. According to Dr Edward Howell from Oxford University, quoted by the BBC, “around 40 to 50% of North Korea’s weapons of mass destruction programmes is funded by cyber and cryptocurrency warfare.”
North Korea has been denying any involvement in those kinds of crimes. Its mission in Geneva has not commented on the allegations. However, the FBI has already linked TraderTraitor to major crypto thefts.
