Within a day of the $6.3 billion Binance hack on 29 October 2026, the companies that trace stolen crypto had settled on a name: TraderTraitor. TRM Labs made the call "with high confidence", Chainalysis said the theft was "likely done by DPRK group TraderTraitor", and on 31 October the FBI said the same.
If that name is new, the organisation behind it is not. The US Treasury treats TraderTraitor as part of the Lazarus Group, the hacking operation run by North Korea's state that has been linked to most of crypto's biggest thefts. This guide explains who they are, how they have operated, and why a country under some of the world's heaviest sanctions keeps getting into the world's best-defended exchanges.
The short version
- Lazarus Group is the umbrella name for North Korean state hackers. TraderTraitor is the unit that specialises in crypto companies.
- North Korea uses stolen crypto to fund its weapons programmes, according to the UN and the US government.
- The group is linked to Ronin ($625 million, 2022), Bybit ($1.5 billion, 2025) and now Binance ($6.3 billion, 2026).
- Its favourite way in is not a software bug but a person: a developer, an engineer or an employee tricked into running malicious code.
- Stolen funds are laundered through swaps, cross-chain bridges and over-the-counter brokers, often over months.
Who is the Lazarus Group?
"Lazarus Group" is a label that security researchers and governments use for hacking teams working for North Korea, mainly under its military intelligence agency, the Reconnaissance General Bureau. It is not one office with one leader that we can see; it is a family of units with overlapping tools and targets. Other names you will see for parts of it include APT38 (bank theft) and BlueNoroff.
Its history predates crypto:
- 2014, Sony Pictures. A destructive attack on the studio over a film mocking Kim Jong Un, attributed to North Korea by the FBI.
- 2016, Bangladesh Bank. An attempt to steal nearly $1 billion through the SWIFT banking network; about $81 million got away.
- 2017, WannaCry. Ransomware that hit hundreds of thousands of computers worldwide, including Britain's National Health Service.
From around 2017 the focus moved to crypto, which is easier to steal across borders and harder to claw back than bank transfers.
What is TraderTraitor?
TraderTraitor is the name the FBI and the US Cybersecurity and Infrastructure Security Agency use for the North Korean cluster that targets crypto exchanges, wallet providers and blockchain companies. The name comes from its early campaigns, which used fake crypto trading apps to infect employees' machines.
The FBI blamed TraderTraitor for the Bybit theft in February 2025 and, according to CBS News, said the same group carried out the Binance attack. Blockchain security firm Blockaid's chief executive, Ido Ben-Natan, told CoinDesk that the tactics and sophistication of the Binance attack were "consistent with the kinds of operations we've seen from DPRK", and linked DPRK actors to the Kelp DAO, Bitget and Drift incidents earlier in 2026 as well.
North Korea's biggest crypto hacks
| Year | Target | Approx. amount | What happened |
|---|---|---|---|
| 2022 | Ronin Network (Axie Infinity) | $625 million | Validator keys compromised after a fake job offer to an engineer |
| 2024 | DMM Bitcoin (Japan) | $305 million | FBI blamed TraderTraitor; a supplier's employee was targeted via a fake recruiter |
| 2025 | Bybit (Dubai) | $1.5 billion | A developer machine at wallet supplier Safe was compromised, then the signing screen was tampered with |
| 2026 | Kelp DAO | $292 million | Attributed to DPRK actors by analytics firms (CoinDesk) |
| 2026 | Binance | $6.3 billion | An engineer's laptop compromised, then hot wallet authorisations abused |
According to figures cited by CoinDesk, crypto thefts attributed to North Korea totalled $2.02 billion in 2025, most of it Bybit. The Binance hack alone is three times that.
How do North Korean hackers break into crypto companies?
The pattern across almost every case is the same: attack the people, not the code.
- Fake job offers. An engineer gets an attractive recruiter message on LinkedIn or Telegram, goes through a realistic interview, and is asked to download a "coding test" or open a "job description" that installs malware. This is the method publicly linked to Ronin and DMM Bitcoin.
- Fake apps and tools. Trojanised trading apps, browser extensions or open-source packages that a developer installs willingly.
- North Korean IT workers. Thousands of remote workers using false identities have been placed in Western tech companies, according to the US Justice Department. They earn salaries for the regime and can provide inside access.
- The supply chain. Instead of attacking the exchange, they attack a supplier the exchange trusts, as they did with Safe in the Bybit case.
- Patience. Analysts believe the Binance attackers prepared for at least 36 hours, and in other cases access has been held for weeks before the theft.
Once inside, they look for the thing that moves money: signing keys, wallet permissions or the software that displays transactions to the people approving them.
How do they launder stolen crypto?
Stealing $6 billion is one problem; spending it is another. The usual sequence, seen in Bybit and now Binance:
- Swap freezable assets fast. Stablecoins can be frozen by Tether and Circle, so they are swapped for ether or bitcoin within minutes. In the Binance case the attacker did not move fast enough: about $3 billion was frozen.
- Spread across chains and wallets. Funds are split across thousands of addresses and moved through cross-chain services such as THORChain.
- Mix and wait. Coins are passed through mixers or simply left to sit until attention fades.
- Cash out through brokers. Over-the-counter traders, often in Asia, convert crypto into cash, sometimes at a large discount.
CoinDesk noted that North Korean groups usually move and sell stolen funds faster and more efficiently than the Binance attackers did, which may be why so much was caught.
Why can't anyone stop them?
- They are a state. There is no extradition, no arrest and little to lose. Sanctions have been in place for years.
- Crypto is global and fast. Twenty minutes was enough to move $6 billion across ten blockchains.
- The weakest link is always human. You can harden servers. It is much harder to guarantee that none of thousands of employees will ever open the wrong file.
What does work, partially, is the response: stablecoin issuers freezing funds, analytics firms tracing wallets in real time, and exchanges blocking deposits from flagged addresses. That is why roughly half the Binance haul is already frozen.
What this means for businesses that are not crypto exchanges
The same playbook, fake recruiters, malicious "test projects", impostor remote hires and supplier compromise, is used against ordinary companies, just for smaller prizes. If you hire remote developers or assistants, or let staff install their own tools, the controls in our device security policy for distributed teams and our cybersecurity guide for Pakistani businesses are the practical starting point. We also break down what the Binance hack teaches every business.
Frequently asked questions
Which Korean hacker group hacked Binance?
Investigators including TRM Labs, Chainalysis and the FBI name TraderTraitor, a North Korean unit that the US Treasury links to the Lazarus Group. South Korea is not involved; this is North Korea (the DPRK).
What is the Lazarus Group?
The name used for North Korea's state hacking teams. They are linked to the Sony Pictures attack, the Bangladesh Bank heist, WannaCry and billions of dollars in crypto thefts.
Why does North Korea steal crypto?
The UN and the US government say the money funds North Korea's weapons and missile programmes and helps the regime get around sanctions.
Is Lazarus behind the Bybit hack too?
Yes. The FBI attributed the $1.5 billion Bybit theft in February 2025 to TraderTraitor, the same unit blamed for Binance.
Will the stolen Binance money be recovered?
About $3 billion has been frozen, mostly stablecoins. TRM Labs estimates about $2.4 billion in bitcoin and ether will never be recovered.
Sources
CoinDesk on attribution, prior hacks and 2025 totals; CBS News for the FBI, TRM Labs and Treasury statements; Wikipedia: 2026 Binance hack; Wikipedia: Lazarus Group for historical incidents; NBC News for recovery estimates. Figures as of 1 November 2026.
