HOW DO THEY OPERATE?
TraderTraitor actors have been known to pose as recruiters offering lucrative jobs to trick victims into downloading malicious software.
The malware can allow hackers to infiltrate victims’ computer systems and steal sensitive information and digital assets.
In a 2024 heist involving the theft of US$308 million from Japanese cryptocurrency exchange DMM Bitcoin, a North Korean hacker posing as a recruiter on LinkedIn contacted an employee of a separate virtual currency wallet software company.
They sent the employee what appeared to be a pre-employment test, which actually contained a malicious line of code.
That allowed the hacker to compromise their system and impersonate the employee, the FBI said.
WHAT HAVE NORTH KOREAN HACKERS DONE?
High-profile cyberattacks attributed to North Korean hackers include the theft of US$81 million from Bangladesh’s central bank in 2016 and the WannaCry ransomware attack that disrupted computers worldwide in 2017.
In 2022, US authorities blamed Lazarus-linked hackers for stealing around US$620 million from the Ronin blockchain network.
The FBI subsequently attributed three more cryptocurrency heists in 2023 to TraderTraitor actors, involving the theft of nearly US$200 million from Atomic Wallet, Alphapo and CoinsPaid.
The scale of the thefts increased dramatically in February 2025, when the FBI blamed TraderTraitor for stealing around US$1.5 billion in virtual assets from cryptocurrency exchange Bybit.
“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets,” the FBI said at the time.
