TraderTraitor is a hacking group linked to North Korea

A North Korean hacking group known for stealing money from cryptocurrency platforms is being linked to a massive $6 billion heist at Binance, the world's biggest crypto exchange.

Two blockchain analysis firms believe the group, called TraderTraitor, could be behind the attack. If confirmed, it would be one of the biggest cryptocurrency thefts ever recorded.

US-based blockchain investigation firm TRM Labs said it had "high confidence" that the North Korean group was responsible.

"TRM attributes the attack to TraderTraitor, North Korea's elite hacking unit, based on robust on- and off-chain intelligence. We make this judgment with high confidence," the firm said.

TRM added that the attack had several similarities with earlier cyber thefts linked to North Korea.

Jony Levin, CEO of blockchain analysis firm Chainalysis, also said the company believed the attack was carried out by the North Korean group.

TraderTraitor is a hacking group linked to North Korea. It is also believed to be part of the larger Lazarus Group, a network of hackers accused of carrying out some of the biggest cyberattacks in the world.

The United States uses the name TraderTraitor to describe a group of cyberattacks linked to North Korea. The FBI, the Cybersecurity and Infrastructure Security Agency (CISA) and the US Treasury Department have all used the name.

North Korea is accused of using cyberattacks to steal money and fund its weapons programme. Cryptocurrency exchanges have become a major target because they hold large amounts of digital money.

The Lazarus Group is among the best-known hacking groups in this space. It has been linked to several major cryptocurrency thefts over the years.

In February 2025, hackers stole around 400,000 Ethereum tokens worth nearly $1.5 billion from Dubai-based cryptocurrency exchange Bybit.

The attack took place on February 21, when hackers managed to steal the cryptocurrency from an offline wallet.

The FBI and blockchain investigation firms, including TRM Labs and Elliptic, blamed North Korea's Lazarus Group for the attack. The hackers were linked to its TraderTraitor operations.

It was the biggest cryptocurrency theft at the time and accounted for a large part of the $2.02 billion stolen from crypto platforms in 2025.

The Lazarus Group has also been linked to other major attacks, including the theft of $625 million from the Ronin Network in 2022 and a $292 million attack on KelpDAO in April.

In 2014, North Korean hackers were accused of breaking into Sony Pictures' computer systems. The attack was believed to be retaliation for the release of The Interview, a comedy film that made fun of North Korean leader Kim Jong Un.

Since then, groups linked to North Korea have been accused of carrying out several major cyberattacks.