Loading threat actor…
TraderTraitor is a North Korean state-sponsored threat actor specializing in cryptocurrency theft from exchanges, wallet providers, and related technology companies. It is tracked under the names Jade Sleet, PUKCHONG, Slow Pisces, Storm-0954, and UNC4899. TraderTraitor is associated with the broader Lazarus ecosystem; Lazarus Group and APT38 are broader or overlapping attribution labels rather than unambiguous synonyms. Its operations generate foreign currency for North Korea and support sanctions evasion and state priorities, including weapons programs. The actor targets software developers, system administrators, and personnel with access to cryptocurrency infrastructure. Initial-access methods include recruitment-themed spearphishing, recruiter and executive impersonation, malicious pre-employment coding assignments, and tampered developer software. Its malware enables remote command execution, replaces legitimate development-tool components, conceals activity, and steals credentials and deployment tokens. Operators conduct internal reconnaissance and lateral movement to reach wallet infrastructure, including through compromised service providers and trusted internal applications. TraderTraitor has been linked to thefts involving Japan’s DMM Bitcoin, India’s WazirX, and Bybit. The February 2025 Bybit theft involved compromise of a Safe wallet developer and manipulation of the transaction-approval interface, causing authorized personnel to approve a transfer of wallet control. An October 2026 Binance intrusion involved malicious developer software, fraudulent recruitment interviews, compromised internal AI tooling, and stolen container-deployment credentials to reach a wallet-signing service. Attackers also abused Ethereum’s EIP-7702 delegation mechanism to maintain unauthorized on-chain execution rights after normal withdrawals were suspended. The theft affected approximately $6.3 billion in cryptocurrency. The actor launders stolen assets through decentralized exchanges, cross-chain bridges, lending protocols, instant-swap services, and bitcoin coinjoins. Techniques include distributing funds among large numbers of wallets and transferring value through liquidity pools or lending receipt tokens to complicate tracing.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
111 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
41 malware families Mallory has associated with this actor across public reporting.
36 additional families tracked in Mallory.
150 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.