A fake coding test sent to one Ginco employee preceded the theft of 4,502.9 BTC, worth $308 million, from DMM Bitcoin. The same trust-first pattern now sits behind a $6.3 billion Binance loss, even though the record does not yet establish how the 2026 intrusion unfolded.
In this article
Why this matters
The Binance loss is not adequately explained as a failure to patch a vulnerable software version. TraderTraitor’s documented operations instead show a consistent method: compromise a person or supplier, inherit that person’s trust, and use legitimate transaction or signing paths to move assets. That distinction changes what defenders should test. A perimeter can withstand hostile traffic while still failing because a session cookie, developer credential or recruiter message carries authority the system implicitly trusts.
The scale reinforces the point. CoinDesk reports that the Binance theft was worth $6.3 billion, more than four times the $1.5 billion Bybit loss, and roughly doubled in one operation the more than $6 billion TRM Labs had estimated North Korean actors had stolen since 2017. The FBI separately states that North Korea was responsible for more than $6 billion in virtual assets taken from Binance on or about October 29, 2026, and calls the activity TraderTraitor (FBI; CoinDesk).
The failed assumption is that technical hardening implies trustworthy authority. TraderTraitor’s cases show that encrypted transaction signing does not protect a system if the identity requesting the signature, the session used to submit it or the supplier operating the interface has already been compromised.
What happened
The FBI’s October 31, 2026 alert attributes the Binance theft directly to TraderTraitor and says the operation occurred on or about October 29. The agency, working with the USSS and IRS-CI, observed the actors converting stolen assets primarily into Ether and then using DeFi and instant swap services to prepare them for further laundering. It asks THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to block transactions involving or derived from listed addresses (FBI).
TraderTraitor is not new. The alias first appeared in an April 2022 FBI, CISA and Treasury advisory describing malware hidden in cryptocurrency trading applications and attacks dating to at least 2020. The same alias set—Jade Sleet, UNC4899 and Slow Pisces—appears in the FBI’s attribution of the DMM Bitcoin theft. CoinDesk describes TraderTraitor as a specialist team within the broader Lazarus ecosystem, while TRM Labs’ April 2026 research treats it as North Korea’s exchange-and-custodian theft unit rather than a synonym for every North Korean operation (CoinDesk).
The operational history is one of concentrated, high-value operations rather than continuous high-volume intrusion. TRM Labs reported that two North Korean attacks—the $285 million Drift Protocol breach and the $292 million KelpDAO bridge exploit—accounted for 76% of crypto hack value through April 2026. TRM assessed the Drift actor as distinct from TraderTraitor while attributing KelpDAO to TraderTraitor (TRM Labs).
| Claim | Status | Basis |
|---|---|---|
| North Korea was responsible for more than $6 billion stolen from Binance | Confirmed | FBI alert |
| CoinDesk valued the Binance loss at $6.3 billion | Reported | CoinDesk reporting |
| TraderTraitor compromised a Ginco employee through a fake coding test | Confirmed | FBI, DC3 and NPA attribution |
| A Safe developer credential was compromised in the Bybit case | Confirmed | Bybit forensic review |
| TraderTraitor compromised Binance through a software engineer | Reported | CoinDesk account of Binance’s security chief |
| The exact technical path of the Binance intrusion is known | Not established | No technical post-incident report in the record |
Tradecraft and the failed assumptions
The DMM Bitcoin case documents the pattern most clearly. In late March 2024, a North Korean actor posing as a LinkedIn recruiter sent a Ginco employee a malicious Python script disguised as a pre-employment coding test. The employee copied the code to a personal GitHub page and was compromised. After mid-May, the actors used session cookie information to impersonate the employee inside Ginco’s unencrypted communications system. In late May, they likely manipulated a legitimate DMM transaction request, producing a loss of 4,502.9 BTC worth $308 million (FBI).
Two assumptions failed there. First, session material was treated as a bearer credential: possession of the cookie was enough to become the employee. Second, an unencrypted communications channel was treated as neutral ground, although it became an attacker-controlled instruction channel once the session was stolen. The transaction itself was not forged; it was manipulated through an authenticated path.
Bybit shows the same structure applied to a signing product. Bybit’s forensic review with Verichains and Sygnia Labs concluded that compromised Safe developer credentials provided unauthorized access to Safe{Wallet} infrastructure and allowed the attacker to deceive signers into approving a malicious transaction. Both external experts found no indication that Bybit’s own infrastructure was compromised, and Bybit had moved the majority of funds out of its Safe-administered addresses on the day of the incident (Bybit).
KelpDAO demonstrates that TraderTraitor also attacks technical trust when the social route is less attractive. The attackers compromised two internal RPC nodes and replaced their software so they reported false blockchain data, then launched a distributed denial-of-service attack against external, uncompromised nodes. The bridge’s verifier failed over to the poisoned internal nodes, which falsely reported that rsETH had been burned on the source chain. The single verifier accepted the fraudulent cross-chain message, allowing the drain of approximately 116,500 rsETH worth approximately $292 million (TRM Labs).
The failed assumption in KelpDAO was that redundancy existed. The rsETH deployment used a single-DVN configuration, so no second independent verifier had to agree. A failover path that concentrates trust under stress is not redundancy; it is a single point of failure by design.
Laundering and the enforcement perimeter
The theft does not end at the exchange. The FBI says TraderTraitor actors primarily convert stolen assets into Ether before using DeFi and instant swap services for subsequent laundering stages. That makes cross-chain routing infrastructure part of the enforcement perimeter, not merely downstream plumbing. The FBI’s request that THORNode operators, RPC node operators, instant exchanges, DeFi services and analytics firms block listed or derived addresses reflects that operational reality (FBI).
TRM Labs independently identifies THORChain as the consistent bridge of choice across North Korea’s largest heists, saying it processed the vast majority of proceeds from both Bybit and KelpDAO. In the KelpDAO case, proceeds moved through THORChain after $75 million was frozen on Arbitrum. TRM also notes that no operator was willing to freeze or reject the transfers, a point that shifts responsibility toward the services carrying the assets (TRM Labs).
Limits of the record
The attribution is stronger than the technical account. The FBI names TraderTraitor for Binance, and the same aliases connect the group to DMM. But the record reviewed here does not contain a Binance forensic report establishing the complete intrusion path, the precise point of initial access or the exact approval mechanism used in the $6.3 billion theft.
CoinDesk reports that Binance’s chief security officer said the recruitment approach returned and refers to a software engineer. That is a reported account, not a published technical finding. It is reasonable to infer continuity with TraderTraitor’s recruitment-based tradecraft, but the inference should not be promoted to a confirmed mechanism without primary forensic evidence.
The record also does not establish that every TraderTraitor operation follows the same sequence. KelpDAO relied on poisoned RPC nodes and a single-verifier design; DMM relied on social engineering and session impersonation; Bybit involved a compromised supplier credential. The common element is abuse of trusted authority, not one universal exploit.
Method and sources
This analysis draws on the FBI’s October 31, 2026 Binance alert and its joint DMM attribution with DC3 and Japan’s National Police Agency, CoinDesk’s November 5, 2026 TraderTraitor profile, TRM Labs’ April 30, 2026 analysis of North Korean crypto theft, and Bybit’s account of the Safe{Wallet} incident. Government attributions are treated as confirmed findings; company statements are identified as such; reported figures and mechanisms are not independently verified here. The record is sufficient to establish TraderTraitor’s identity, prior tradecraft and Binance attribution, but not the full technical sequence of the Binance intrusion.