State-backedNorth Korea
TraderTraitor
Also known as Jade Sleet, UNC4899, Pukchong
38mentions, 7 days
39mentions, 30 days
Nov 5, 2026last mentioned
TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
Recent activity
- TraderTraitor vs Contagious Interview - A Look at Binance's Initial Incident Report https:// infosec.pub/post/54550988 [ https:// infosec.pub/u/digicat ] # mastodon · Nov 5, 2026
- TraderTraitor vs Contagious Interview - A Look at Binance's Initial Incident Reportreddit · Nov 5, 2026
- Binance Heist: What We Know, and What RL Sees in TraderTraitor's Toolkit https:// packetstorm.news/news/view/473 02 # newsmastodon · Nov 5, 2026
- TraderTraitor vs Contagious Interview - A Look at Binance's Initial Incident Report published by SecurityAlliance. # TraderTraitor , # ContagiousInterview ,mastodon · Nov 5, 2026
- 推定1兆円相当のBinanceの不正出金事案についてまとめてみた published by piyokango. # TraderTraitor , # Binance https:// piyolog.hatenadiary.jp/entry/2 026/10/30/230303mastodon · Nov 5, 2026
- Binance heist: what we know, and what RL sees in TraderTraitor's toolkit published by ReversingLabs. # Phishing , # TraderTraitor , # FLATROOF , # ROOFDECK mastodon · Nov 5, 2026
- Breaking Down the Binance Hack: Timeline, Laundering Routes, and How Polytrop Helps Businesses Spot Stolen Funds published by AMLBot. # TraderTraitor , # MoneyLmastodon · Nov 4, 2026
- Binance Hack Update: North Korea Launders Proceeds Through Self-Minted Tokens and Chained Bridges published by Trmlabs. # TraderTraitor , # MoneyLaundering , # mastodon · Nov 4, 2026
- THORChain Restarts Most Swaps After Analyst Said Operators Would Expect North Korea to Launder published by Unchained. # TraderTraitor , # MoneyLaundering , # Bmastodon · Nov 4, 2026
- Binance Hot Wallet Compromise and Multi-Chain Asset Theft Incident Analysis Report published by S2W. # TraderTraitor , # MoneyLaundering , # Binance https:// s2mastodon · Nov 4, 2026
- 29 October 2026 Binance Security Incident: Initial Findings and Response Update published by Binance. # TraderTraitor , # Binance https:// binance.com/en/blog/cmastodon · Nov 4, 2026
- How North Korea is laundering the $6.4 billion stolen from Binance published by Elliptic. # TraderTraitor , # MoneyLaundering , # Binance https://www. elliptic.mastodon · Nov 3, 2026
- FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactions # TraderTraitor # Binance https:// therecord.media/fbi-blamesmastodon · Nov 2, 2026
- 🤖 FBI attributes the $6.36B Binance theft (Oct 29) to TraderTraitor/Lazarus. Entry point: a compromised DevOps engineer's laptop → service container accessmastodon · Nov 2, 2026
- FBI ties North Korea’s TraderTraitor group to HIGH-severity $6.3B Binance theft — 608 ETH, 19 BTC, 1 SOL addresses flagged. Automated laundering via DeFi ongoinmastodon · Nov 2, 2026
- FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heistnews · Nov 2, 2026
- Binance exploit: about $242M laundered through the Tron leg in two days published by SomaXBT. # TraderTraitor , # MoneyLaundering , # Binance https:// x.com/sommastodon · Nov 2, 2026
- FBI attributes $6.43B Binance theft to TraderTraitor (North Korea / Lazarus Group). Largest crypto heist ever. Entry point: one DevOps laptop with container accmastodon · Nov 2, 2026
- Binance Lost $6.3 Billion Without Losing a Key published by ThreatMon. # TraderTraitor , # Binance https:// threatmon.io/binance-lost-6-3- billion-without-losinmastodon · Nov 2, 2026
- FBI blames N. Korea’s TraderTraitor for Binance theft, urges crypto industry to block transactionsnews · Nov 2, 2026
- ‼️ FBI confirms North Korea's TraderTraitor hackers were behind the record $6.43 billion Binance crypto heist. $2.85 billion in stolen assets has been frozemastodon · Nov 1, 2026
- 🤖 FBI attributes the $6.3B Binance crypto theft to TraderTraitor, the DPRK group also tracked as Jade Sleet, UNC4899 and Slow Pisces. Joint statement with USSSmastodon · Nov 1, 2026
- The FBI has confirmed that North Korean state-sponsored hackers known as TraderTraitor were behind the $6.3 billion crypto-theft attack on Binance, making it thmastodon · Nov 1, 2026
- 🔒 Security News Digest - 2026-11-01 📊 5 updates from 2 sources: 🔹 The Hacker News: NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NETmastodon · Nov 1, 2026
- The FBI attributed the $6.43B Binance heist to North Korea's TraderTraitor actors. The record-scale theft highlights persistent targeting of crypto exchangemastodon · Nov 1, 2026
References
- https://www.mandiant.com/resources/blog/north-korea-supply-chain
- https://us-cert.cisa.gov/ncas/alerts/aa22-108a
- https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023
- https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targeting-brazil
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.