Lazarus Group & TraderTraitor: How North Korea Steals Billions in Crypto

Last updated: November 1, 2026

On October 31, 2026, the FBI confirmed what blockchain investigators had suspected for two days: North Korea was behind the $6.3 billion Binance hack. The group it named was TraderTraitor, a crypto unit of the Lazarus Group, the same team the FBI blamed for the $1.46 billion Bybit hack in February 2025.

North Korea is now the biggest crypto thief in the world by far. This guide explains who the Lazarus Group and TraderTraitor are, the biggest hacks linked to them, how they break in, how they launder billions and what you can do to protect yourself.

Who Is the Lazarus Group?

Lazarus Group is the name security researchers use for North Korea's state-backed hackers. According to US and South Korean officials, the hackers work for the Reconnaissance General Bureau, North Korea's main military intelligence agency.

The group first became widely known for the 2014 hack of Sony Pictures. In 2016 it tried to steal $1 billion from Bangladesh's central bank through the SWIFT banking network and got away with about $81 million. In 2017 it was blamed for the WannaCry ransomware attack. Since then, its focus has shifted almost completely to crypto, because crypto is easier to steal and harder to freeze than money in banks.

In 2021 the US Justice Department charged three North Korean military hackers, Park Jin Hyok, Jon Chang Hyok and Kim Il, with crimes that included crypto theft. None of them has been arrested, because they are in North Korea.

What Is TraderTraitor?

TraderTraitor is the part of Lazarus that specializes in stealing from crypto companies. US agencies, including the FBI and CISA, named it in an April 2022 advisory warning that it was targeting crypto exchanges, DeFi projects and their employees.

Different security companies use different names for the same group, which is why the news can be confusing:

So when you read that "Jade Sleet" or "UNC4899" attacked a crypto company, it usually refers to the same North Korean team the FBI calls TraderTraitor.

The Biggest Crypto Hacks Linked to North Korea

Here are the largest crypto thefts linked to North Korea, with who made the link. Amounts are the value at the time of each attack.

For the full list of crypto hacks, including the ones not linked to North Korea, see our guide to the biggest crypto hacks of all time.

How Much Crypto Has North Korea Stolen?

The numbers have grown very fast:

• Up to 2025: Chainalysis counted about $6.75 billion stolen by North Korea since it started tracking.
• 2025: a record $2.02 billion, about 59% of all crypto stolen that year, according to Chainalysis. Most of it came from the Bybit hack.
• 2026 before Binance: TRM Labs said North Korea took about $577 million by the end of April, or 76% of all crypto hack losses, from just two attacks, Drift and Kelp DAO.
• 2026 with Binance: the Binance hack added about $6.3 billion in one day, and the suspected Bitget hack about $387 million more.

Put together, North Korea-linked hackers took more in 2026 than in all previous years combined. TRM Labs data also shows how their share keeps rising: about 22% of all crypto hack losses in 2022, 37% in 2023, 39% in 2024, 64% in 2025 and 76% in early 2026.

The strange part is that the number of attacks is falling. Chainalysis found that North Korea carried out far fewer known attacks in 2025 than the year before, but each one was much bigger. They now spend months preparing a few huge hits instead of many small ones.

How TraderTraitor Breaks In

TraderTraitor rarely breaks blockchain code directly. Its main target is people: the engineers and staff who have access to a company's wallets and internal systems.

1. Fake job offers

The most famous trick. Hackers pose as recruiters on LinkedIn, Telegram or X and offer a well-paid job at a crypto or AI company. During the "interview", the target is asked to download a coding test, a trading app or a PDF. The file contains malware that gives the hackers control of the laptop. Microsoft reported in 2026 that the group set up fake companies and ran several fake hiring campaigns within days, using AI to research targets and scale its outreach.

2. Hacking a developer's laptop

Once a work laptop is infected, the hackers can wait for weeks, learn how the company's wallet systems work and plan the theft. In the Binance hack, the company's first findings pointed to a compromised DevOps engineer's laptop. In the Bybit hack, attackers got into a developer machine at Safe, the wallet provider Bybit used, and changed what Bybit's signers saw on screen.

3. Poisoned software packages

The group has published fake or infected code packages on npm and GitHub, hoping developers install them in their projects. One install on the right machine can be enough.

4. Getting hired for real

North Korean IT workers apply for remote jobs at crypto companies using fake identities, sometimes with AI-generated video and voice changers in interviews. Binance has said it sees attempts like this every day. Once inside, they can collect information or open a door for the hackers.

5. Tricking the signers

Big exchanges protect cold and hot wallets with multiple approvals. TraderTraitor's specialty is making a malicious transaction look normal, so that the people approving it sign without knowing. In the Binance case, Binance said the attackers abused EIP-7702 to take control of a hot wallet without passing its normal approval checks.

How North Korea Launders Stolen Crypto

Stealing is only half the job. Turning billions of dollars of tracked crypto into usable money is the hard part, and the group has a well-practiced playbook:

• Swap fast. Stablecoins like USDT and USDC can be frozen, so they are swapped into ETH within minutes. After the Binance hack, the FBI said the stolen assets were mainly converted into ETH.
• Split everything. Funds are spread across thousands of new addresses. Chainalysis expects the Binance funds to reach tens of thousands of addresses in the coming weeks.
• Jump between blockchains. Cross-chain bridges and swap services, especially THORChain, are used to move ETH into BTC. After Bybit, most of the stolen ETH was turned into BTC within about ten days.
• Use mixers. Services like Tornado Cash and Sinbad were used in the past. The US sanctioned both, and the group shifted more to bridges and no-KYC swap services.
• Cash out through brokers. The last step usually runs through over-the-counter brokers and Chinese-language money laundering networks. Chainalysis describes a laundering cycle of about 45 days, in three waves.

After a hack, investigators and the industry fight back. Tether, Circle and other issuers freeze stablecoins, and the FBI publishes lists of hacker addresses so exchanges can block them. After the Binance hack, Binance and its partners froze about $3 billion, mostly stablecoins. But once the money is in ETH and BTC, very little is usually recovered.

Why Does North Korea Steal Crypto?

North Korea is under some of the strictest sanctions in the world, which cut it off from most banks and trade. Crypto theft brings in foreign currency that is hard to block.

UN experts and blockchain researchers say this money helps fund the country's weapons programs. In 2023 a senior White House official said about half of North Korea's missile program was being paid for by cyber attacks and crypto theft. Chainalysis has also linked stolen funds to purchases of military equipment.

That is why a crypto hack by Lazarus is treated as a national security issue and not just a crime, and why the FBI moved within two days to name the group behind the Binance hack.

Can They Be Stopped?

Arrests are almost impossible, because the hackers stay in North Korea. The fight happens in other ways:

• Sanctions. The US Treasury keeps adding people, companies and services linked to North Korean laundering and IT workers to its sanctions lists, most recently in March 2026.
• Freezes and blocklists. Exchanges, stablecoin issuers and analytics firms share hacker addresses in real time.
• Better security at exchanges. Hardware security keys, strict device rules for staff, and checking what a transaction really does before signing it.

Still, the numbers show the hackers are ahead for now. Every big hack gives them more money to spend on the next one.

How to Protect Yourself

Normal users are not usually TraderTraitor's direct target, but you can still get hurt. When an exchange is hacked, withdrawals pause, prices drop and scammers move in. A few simple rules help:

• Keep only your trading money on exchanges. Long-term holdings belong in a wallet you control.
• Turn on strong security: an authenticator app or security key, a withdrawal address whitelist and an anti-phishing code.
• Ignore anyone who DMs you after a hack. Fake support and fake compensation offers always follow big hacks.
• If you work in crypto or tech: be careful with unexpected job offers, and never run a "coding test" or download a file from a recruiter on your work computer.

We cover all of this step by step in our guide on how to protect your crypto after an exchange hack. If you have money on Binance right now, read is Binance safe after the hack.

Frequently Asked Questions

Who is the Lazarus Group?

Lazarus Group is the name for North Korea's state-backed hackers. US and South Korean officials say it is run by the Reconnaissance General Bureau, North Korea's military intelligence agency. It is blamed for the 2014 Sony Pictures hack, the 2016 Bangladesh Bank theft, WannaCry and most of the biggest crypto hacks of the last five years.

What is TraderTraitor?

TraderTraitor is the crypto-focused unit inside the Lazarus Group. US agencies named it in an April 2022 advisory. Security firms also call it Jade Sleet, UNC4899 and Slow Pisces. The FBI says it carried out the Bybit hack in 2025 and the Binance hack in 2026.

Did North Korea hack Binance?

Yes, according to the FBI. On October 31, 2026, the FBI said North Korea's TraderTraitor group stole about $6.3 billion from Binance on October 29, and shared more than 600 Ethereum addresses used to launder the money.

How much crypto has North Korea stolen?

Chainalysis counted about $6.75 billion stolen by North Korea up to the end of 2025, including a record $2.02 billion in 2025. In 2026, the Binance hack alone added about $6.3 billion, so North Korea-linked theft has roughly doubled in one year.

Why does North Korea steal crypto?

Heavy sanctions cut North Korea off from most of the world's money. Crypto theft brings in hard currency that researchers and the UN say helps pay for its weapons and missile programs.

Can crypto stolen by Lazarus be recovered?

Only a small part. Stablecoin issuers can freeze USDT and USDC, and exchanges can block flagged addresses, but most of the money is quickly swapped into ETH and BTC and moved through bridges and laundering networks. After Bybit, less than a tenth was frozen.

Figures come from the FBI, Chainalysis, TRM Labs, the affected companies and news reports, valued at the time of each theft. Some numbers may change as investigations continue. This article is for information only and is not financial advice.