The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).
“It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the FBI said in a statement.
The agency has also provided a list of wallet addresses that the attackers are said to be using to launder the stolen assets.
The development comes as Binance said it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident.
“Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services,” Binance said in a statement.
“We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident.”
The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.
“This single incident almost doubles the total cryptoassets stolen by the regime,” blockchain analysis firm Elliptic said. “Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen over $6.5 billion in cryptoassets in recent years.”
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
TraderTraitor is the name assigned to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading malware-laced applications. The cluster is known to be active since at least 2020.
In recent years, the adversary has been attributed to cryptocurrency heists targeting DMM Bitcoin, Bybit, KelpDAO, and Bitget.
Reports from SentinelOne, Zscaler ThreatLabz, and Microsoft have revealed that TraderTraitor is continuing to hone its tradecraft, using trojanized Terraform providers as a malware distribution vector and leveraging front companies to conduct job-themed targeting against individuals involved in cybersecurity, AI, blockchain, and talent recruitment companies.
The poisoned Terraform provider is used to deliver a Bash loader that selects and downloads malware tailored to the victim’s operating system. This includes a cross-platform implant called FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before ultimately dropping the ROOFDECK backdoor to obtain complete remote control.
The activity once again demonstrates how North Korean threat actors continue to abuse trusted developer workflows through trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, and gain persistent access.
TraderTraitor’s modus operandi, like other North Korea-linked campaigns such as Lazarus Group’s Operation Dream Job and Famous Chollima’s Contagious Interview, employs recruitment-themed lures as a pretext to convince victims to run malicious code. The social engineering phase is augmented by the use of artificial intelligence (AI) to craft convincing lures, create fake personas, and evade detection.
“The actor leveraged tailored domains, social media profiles, and industry-specific knowledge to pose as recruiters for a spoofed AI-powered blockchain intelligence company, using software engineer-themed opportunities to initiate contact and schedule interviews with individuals who engaged with the outreach,” Microsoft said.
“Within this short time frame, Jade Sleet conducted similar job-themed targeting using two additional front companies, supported by comparable infrastructure and relevant domain knowledge.”
