$6.3B gone: Meet TraderTraitor, the elite North Korean hackers accused of the 'largest bank heist in human history'

The FBI named TraderTraitor as the group responsible for a $1.5 billion hack of Bybit in February of last year. It’s also suspected to be involved in the KelpDAO hack that occurred in April.

TraderTraitor’s focus

TraderTraitor is one of the most elite hacker groups known today. While some state-sponsored groups focus on espionage or discovering sensitive information, this group specializes in crypto crimes. The currency it steals can then be used to fund operations in the country, including North Korea’s burgeoning nuclear program.

The group, which emerged in 2022, is part of a larger North Korean hacker collective known as Lazarus Group, which is reportedly run from the Reconnaissance General Bureau, North Korea’s intelligence agency. (Lazarus gained notoriety in 2014 when it was accused of hacking Sony Pictures in retaliation for a film that mocked Kim Jong-Un.) TraderTraitor is also known as Jade Sleet, Slow Pisces and UNC4899.

The group, like many hacker collectives, has increasingly been using artificial intelligence to assist with its attacks. A report from Microsoft, released Thursday, found that in June of this year, TraderTraitor (operating as Jade Sleet) had posed as recruiters “for a spoofed AI-powered blockchain intelligence company, using software engineer-themed opportunities to initiate contact and schedule interviews with individuals who engaged with the outreach.” The group operated three such fronts in a four day period.

After running an AI analysis of the information collected from those talks, the group can “accelerate operational workflows, including rapidly developing target- and industry-specific knowledge, tailoring reconnaissance and targeting, and scaling outreach to target individuals,” Microsoft wrote.