TraderTraitor
A North Korean hacking group that targets cryptocurrency companies, according to TRM Labs. It is believed to be part of the Lazarus Group.
- Attribution
TRM Labs says it has "high confidence" that TraderTraitor, "a North Korean hacking group", carried out the October 2026 Binance heist, based on on-chain and off-chain intelligence. [1]
SecurityWeek reports that the FBI blamed the Binance theft on TraderTraitor, which it calls a North Korean state-sponsored group. North Korea called the attribution "a grave political provocation". [2]
Euronews notes that the FBI named the same group for the $1.5 billion Bybit hack of February 2025. [1]
On November 12, 2026, the US Justice Department said "members of the North Korean military, referred to by the FBI as 'TraderTraitor'" stole more than $6 billion from Binance. [3]