TraderTraitor: North Korea’s Crypto-Heist Machine

TraderTraitor is a U.S.-government codename for a cluster of DPRK state-sponsored cryptocurrency-theft activity, overlapping vendor names including Jade Sleet (Microsoft), UNC4899 (Google/Mandiant) and Slow Pisces (Unit 42). The April 2022 FBI/CISA/Treasury joint advisory (AA22-108A) links the activity to the DPRK and specifically to the Reconnaissance General Bureau (RGB). The attribution is high confidence, but “TraderTraitor = Lazarus” is an oversimplification: the U.S. government groups several DPRK sub-clusters under this label, overlapping APT38/BlueNoroff financial operations.

Attribution

North Korean, high confidence, linked to the RGB per AA22-108A. TraderTraitor itself has no dedicated MITRE group ID — it is a government codename. The associated MITRE groups are Lazarus Group (G0032) and APT38 (G0082). Be precise: the 2022 Ronin/Axie Infinity attribution was to Lazarus Group specifically, not to TraderTraitor, even though the advisory followed weeks later.

Targeting

Cryptocurrency, blockchain, DeFi and exchange companies — specifically employees in system-administration and software/DevOps roles with wallet or infrastructure access. Global, with notable victims in Japan and the U.S. crypto sector.

Notable Campaigns

• March 2022 (Ronin/Axie Infinity): the bridge heist, attributed by U.S. Treasury/OFAC to Lazarus Group; losses reported at roughly US$620–650M (figure varies by outlet). Attribute to Lazarus, not TraderTraitor.
• July 2023 (JumbleCloud): a supply-chain intrusion via spear-phishing, with follow-on activity tied by Mandiant to UNC4899.
• 2023 (GitHub/npm): a social-engineering campaign GitHub attributed to Jade Sleet/TraderTraitor.
• May 2024 (DMM Bitcoin): jointly attributed to TraderTraitor by Japan’s National Police Agency, the FBI and DC3; losses reported at roughly ¥48.2B / US$308M per that joint statement, beginning with a fake-recruiter contact to a wallet-software employee.
• February 2025 (Bybit): roughly US$1.4B, reported by vendors as this DPRK cluster — attribute to vendor reporting, not a formal advisory.

Malware & Tooling

Cross-platform JavaScript/Node.js and Electron trojanised cryptocurrency apps named in AA22-108A (DAFOM, TokenAIS, CryptAIS, AlticGO, Esilet, CreAI Deck). From 2023, tradecraft shifted toward malicious npm packages and trojanised tools, and by 2024–2025 to luring employees into running malicious Docker containers.

MITRE ATT&CK Mapping

Detection & Mitigation

• Treat unsolicited recruiter or job “assignments” and crypto/trading apps as hostile; never install or run them on wallet-bearing or privileged machines.
• Lock down the developer supply chain: vet npm and GitHub dependencies and restrict running untrusted Docker containers on endpoints.
• Enforce phishing-resistant MFA and strict privileged-access management; custody keys in HSMs or multisig so a single endpoint compromise cannot move funds. Review AA22-108A detections.