The name TraderTraitor appeared in an April 2022 advisory from the FBI, Cybersecurity and Infrastructure Security Agency and Treasury Department. It described malware hidden in cryptocurrency trading apps and attacks on exchanges, decentralized finance protocols and investors dating to at least 2020.
The group is also tracked as Jade Sleet, UNC4899 and Slow Pisces, within the broader network of North Korean hacking operations researchers commonly call Lazarus.
U.S. agencies say its purpose is to raise money for Pyongyang, warning in 2022 that the hackers would keep targeting crypto companies “to generate and launder funds to support the North Korean regime.”
The North Korean government has, at least on one occasion, attempted to use USDT to buy Russian oil.
Tom McLouth, a senior intelligence analyst at Chainalysis, told CoinDesk in an interview that TraderTraitor is a “financially motivated DPRK threat group that has a preference for targeting cryptocurrency-related organizations, institutions, DAOs, protocols, what have you.”
But these aren’t the hackers we see in movies, so outstandingly skilled at code they outperform crypto exchanges’ security. They have a different modus operandi, one that exploits human weaknesses rather than AI-hardened code.
From recruitment to stolen funds
In March 2024, someone posing as a LinkedIn recruiter contacted an employee of Ginco, a Japanese wallet software company. The recruiter sent the employee a supposed coding test hosted on GitHb, but within it was malicious code that ended up compromising the employee’s computer.
Leave a Reply