The Bybit cryptocurrency exchange suffered a massive security breach on Friday, February 21, when hackers stole an estimated $1.5 billion worth of cryptocurrency. The cybercriminals utilized TraderTraitor applications to gain unauthorized access to the exchange’s systems. marking another high-profile attack linked to the reclusive DPRK regime’s hacking operations.

The agency claimed the theft of the virtual assets from the cryptocurrency exchange utilized a specific cluster it tracks as TraderTraitor, also referred to as Jade Sleet, Slow Pisces, and UNC4899.

This marks another high-profile attack linked to the reclusive DPRK regime’s hacking operations.

 According to a statement from the FBI on Wednesday, February 26, the attack has been attributed to state-sponsored actors in the Democratic People’s Republic of Korea (DPRK), commonly known as North Korea.

When the FBI linked the record-breaking hack to North Korean threat actors, Bybit CEO Ben Zhou declared a "war against Lazarus."

FBI Identifies TraderTraitor as the Attack Vector

In an official advisory, the FBI outlined how North Korean actors carried out the attack, stating:

“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains. It is expected these assets will be further laundered and eventually converted to fiat currency.”

The federal agency has identified more than 50 Ethereum addresses connected to the attack and is urging the private sector to block transactions associated with these addresses. The hackers are reportedly attempting to launder the stolen funds and convert them into legal tender.

North Korea’s Ongoing Crypto Attacks

The U.S. government has long monitored North Korean cyber activities, particularly their focus on blockchain and cryptocurrency-related businesses. A Cybersecurity Advisory issued in April 2022 warned:

“The U.S. government has observed North Korean cyber actors targeting a variety of organizations in the blockchain technology and cryptocurrency industry, including cryptocurrency exchanges, decentralized finance (DeFi) protocols, play-to-earn cryptocurrency video games, cryptocurrency trading companies, venture capital funds investing in cryptocurrency, and individual holders of large amounts of cryptocurrency or valuable non-fungible tokens (NFTs).”

The advisory also noted that North Korean hackers use social engineering tactics on various communication platforms to "trick victims into downloading trojanized cryptocurrency applications on both Windows and macOS operating systems."

Relevant Cybersecurity Advisories:

• IC3 Public Service Announcement (2025)
• TraderTraitor Cybersecurity Advisory (2022)
• Hidden Cobra FASTCash Campaign (2018)
• North Korean Cyber Threat Advisory (2020)

A History of North Korean Hacking 

This is not the first large-scale cryptocurrency theft attributed to North Korean hackers. In 2023, the same state-sponsored group was responsible for a $600 million crypto theft.

North Korea first gained global notoriety for its cyber activities in 2014 when it allegedly hacked Sony Pictures in retaliation for The Interview, a satirical film starring Seth Rogen and James Franco, which depicted a fictional assassination attempt on North Korean Supreme Leader Kim Jong Un.

How North Korean Hackers Operate

North Korean hacker groups use a combination of technical expertise and social engineering tactics to compromise systems. Their primary techniques include:

• Deploying malicious TraderTraitor applications to gain access to victim networks.
• Exploiting security vulnerabilities to steal private keys.
• Laundering stolen funds through thousands of blockchain addresses before converting them into fiat currency.

The Lazarus Group and State-Sponsored Cybercrime

Despite lacking free public internet access, North Korea has developed an elite hacking force, including the infamous Lazarus Group, which has been linked to numerous financial crimes worldwide.

North Korean cybercriminals were also behind the 2017 WannaCry ransomware attack, which infected hundreds of thousands of devices in over 150 countries. Many experts believe these cyber activities help fund North Korea’s military and nuclear programs.

Growing Threat of N. Korean Cyber Attacks

The U.S. government has been issuing warnings about North Korean state-sponsored cyber actors since 2018. Given the scale and sophistication of these operations, cybersecurity experts continue to urge financial institutions, cryptocurrency exchanges, and blockchain developers to strengthen security protocols.

With Bybit’s recent hack, it is evident that TraderTraitor remains an active and dangerous threat to the world’s cryptocurrency security. The full extent of North Korea’s involvement in crypto-related cybercrimes is still unfolding, but one thing is clear—it represents a global cybersecurity crisis that demands immediate attention.