Six billion dollars. That is the number the FBI put on a single hacking operation this week, and it belongs to TraderTraitor, a North Korean crew that also answers to Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899 depending on which agency you ask.

The attribution came jointly from the FBI, the Secret Service, and IRS Criminal Investigation. All three say they watched the group convert the stolen assets into Ethereum almost immediately, and they expect the next move to be DeFi swaps and instant exchange services designed to break the trail.

They also published wallet addresses. That is the part exchanges should act on today.

The Numbers, and Why They Matter

Bybit lost $1.46 billion in February 2025. That felt catastrophic at the time. This is more than four times larger.

Elliptic's read on it is blunt: this one incident nearly doubles the regime's lifetime crypto haul. North Korea-linked actors now sit above $6.5 billion in total stolen digital assets.

Nearly Half Is Already Frozen

Here is the part that rarely gets enough credit. Tether, Circle, Ripple, Arbitrum, and Optimism moved fast and froze $2.85 billion on-chain.

That is a real win, and it happened because stablecoin issuers and L2 operators can act on a court order or a sanctions designation in hours. It is also the reason the attackers are pivoting to DeFi, where no one has a freeze button.

Binance Blinked, Then Reopened

Binance paused withdrawals after the incident, then restored phase one between 6 and 9 a.m. UTC.

The company's statement was careful. Precautionary measures, security assessments, verified readiness. Deposits never stopped.

Reading between the lines, a $6 billion theft makes every exchange nervous about its own treasury and hot wallet exposure. A short withdrawal freeze is the cheapest insurance available.

Who They Are and What They Have Done

TraderTraitor has been running since at least 2020. DMM Bitcoin, Bybit, KelpDAO, and Bitget all show up in their attribution history.

Their signature is not smart contract exploitation. It is social engineering aimed at developers, followed by malware.

The Terraform Problem

This is the part security teams should print out and pin to the wall.

Microsoft, SentinelOne, and Zscaler ThreatLabz have all documented TraderTraitor poisoning Terraform providers. A developer pulls what looks like a normal provider. A Bash loader fires, picks malware for the host OS, and installs.

First comes FLATROOF, a cross-platform implant with a Python stealer inside it. Then comes ROOFDECK, a backdoor that hands over full remote control.

Terraform providers are trusted infrastructure plumbing. Nobody reviews them. That is exactly why they were chosen.

The Recruiter Playbook, Now With AI

The delivery mechanism is a job offer. Sometimes a coding test. Sometimes an interview.

TraderTraitor builds fake company domains and social profiles. Microsoft described the group posing as recruiters for a spoofed AI-powered blockchain intelligence firm, using software engineer roles to open conversations with people in crypto, AI, and security.

The AI piece is what changed. Lures are now written in fluent industry language, personas are consistent across platforms, and the fake companies have plausible infrastructure behind them. Microsoft says Jade Sleet ran the same play through two additional front companies within a short window.

What to Do This Week

• Audit Terraform providers. Pin versions and verify hashes. If your team pulls providers casually, that is the gap.
• Hunt for FLATROOF and ROOFDECK. Focus on developer laptops and build machines, not just servers.
• Ingest the FBI wallet list. Exchanges, DeFi protocols, and stablecoin issuers should block those addresses now, before the funds fragment further.
• Brief your engineers on recruiter scams. The target is not the CFO. It is the mid-level blockchain developer who gets a LinkedIn message.
• Verify before you run. No coding challenge should require executing an unfamiliar binary or a private package.

FAQ

What is TraderTraitor?

A North Korean state-sponsored hacking group active since at least 2020. They specialize in stealing cryptocurrency by getting developers to run malware. Other tracking names include Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.

How much did they steal?

Over $6.43 billion across 11 blockchains. Roughly 82% of it was held in Ethereum and Bitcoin. It is the largest crypto theft on record.

Has any of it been recovered?

About $2.85 billion was frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism. The remainder is being laundered through DeFi and instant swaps.

What is the current attack vector?

Trojanized Terraform providers. A poisoned provider delivers a Bash loader, which installs the FLATROOF stealer and the ROOFDECK backdoor depending on the operating system.

How are they getting developers to install it?

Fake recruiters. The group builds front companies with realistic domains and social profiles, uses AI to write convincing outreach, and schedules interviews or coding tests that end with the victim running malicious code.

Source: The Hacker News