TraderTraitor: names, history, and previous targets
The FBI has attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group tracked under multiple cluster names, including Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899. The agency says the cluster has been active since at least 2020 and has a history of orchestrating cryptocurrency thefts by tricking victims into downloading malware-laced applications.
Public reporting ties the adversary to past heists and campaigns against DMM Bitcoin, Bybit, KelpDAO, and Bitget. Industry analysts and vendors have documented the group’s evolving tradecraft, noting continued refinement of malware delivery and social-engineering techniques.
The scale of the theft and immediate market impact
The FBI and partner agencies attribute $6.43 billion in stolen cryptoassets to TraderTraitor. The funds were taken across 11 blockchains, with 82% of the total on Ethereum and Bitcoin. The haul eclipses the $1.46 billion plundered from Bybit in February 2025; blockchain analysis firm Elliptic summarized the magnitude with a stark assessment: "This single incident almost doubles the total cryptoassets stolen by the regime."
Binance, which paused withdrawals after the incident, said it resumed phase one of withdrawals beginning today between 6 and 9 a.m. UTC. In a statement, Binance said teams "have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services," adding that deposit services remain open and are not affected by the incident.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageOn-chain response: conversion, freezing, and the wallets to watch
The FBI, together with the U.S. Secret Service and IRS Criminal Investigation, reported observing the threat actor converting stolen assets primarily into Ethereum, a step they say precedes further laundering. The agency provided a list of wallet addresses it alleges the attackers are using to launder funds.
Private and protocol actors have already frozen material portions of the haul on-chain: of the $6.43 billion stolen, $2.85 billion of the assets have been frozen by Tether, Circle, Ripple, Arbitrum, and Optimism. The FBI warned that the attackers are likely to leverage decentralized finance (DeFi) and instant swap services to move remaining funds into further laundering stages.
Tradecraft: trojanized Terraform providers, FLATROOF, and AI-augmented lures
Security firms and Microsoft have documented the technical methods used by TraderTraitor. SentinelOne, Zscaler ThreatLabz, and Microsoft reported the group has been trojanizing Terraform providers as a malware distribution vector. Those poisoned providers deliver a Bash loader that selects and downloads malware tailored to the victim’s operating system.
The cross-platform implant described in reporting is called FLATROOF, a Python-based information stealer that siphons sensitive data, and it ultimately drops a ROOFDECK backdoor to obtain persistent remote control. Microsoft detailed how the campaign used recruitment-themed lures and front companies to draw victims in, noting: "The actor leveraged tailored domains, social media profiles, and industry-specific knowledge to pose as recruiters for a spoofed AI-powered blockchain intelligence company, using software engineer-themed opportunities to initiate contact and schedule interviews with individuals who engaged with the outreach."
What this means for technologists, cryptocurrency platforms, and open-source maintainers
- Technologists and security teams: Expect heightened targeting of developers and security professionals through job- and recruitment-themed lures. The use of trojanized Terraform providers and multi-stage loaders means organizations should scrutinize third-party infrastructure-as-code components and their supply chains.
- Cryptocurrency exchanges and custodians (including Binance, Tether, Circle, Ripple, Arbitrum, Optimism): The incident underscores the operational imperative of rapid on-chain intervention—the $2.85 billion frozen shows coordinated responses can limit immediate movement, but the FBI’s warning about conversion to Ethereum and DeFi-based swaps highlights persistent exposure across chains and protocols.
- Open-source and tooling maintainers (Terraform ecosystem): The reported abuse of Terraform providers as a distribution vector makes supply-chain hardening and provenance validation central priorities. Maintainers and consumers of provider binaries and modules will need to validate sources and consider stronger operational controls for developer toolchains.
The FBI’s attribution and the detailed technical reporting together paint a picture of a sophisticated, multi-year campaign that blends social engineering, supply-chain compromise, cross-platform malware, and on-chain financial maneuvers. With $2.85 billion already frozen and exchanges beginning phased restoration of services, the immediate disruption has been bluntly felt; the longer arc—whether the remaining funds can be converted through DeFi and instant-swap services as the FBI expects—remains the critical question for investigators and custodians alike.
Read the original report: https://thehackernews.com/2026/11/fbi-links-north-koreas-tradertraitor-to.html
