Executive summary

TraderTraitor is the activity label used by the US Federal Bureau of Investigation (FBI) for North Korean cryptocurrency theft involving developer compromise and manipulation of trusted business processes. The current CrowdStrike profile cross-references it to Pressure Chollima, while GitHub identifies Microsoft’s name as Jade Sleet. We assess that treating developer sessions and downstream transaction authority as one investigation scope is likely (B2) to reveal exposure that endpoint-only containment would leave unresolved.

Identity, status and naming boundaries

Field Current assessment and source
Principal names Pressure Chollima, CrowdStrike; Jade Sleet, Microsoft; TraderTraitor, FBI activity label
Other directly documented tracking names The FBI’s December 2024 statement lists UNC4899 and Slow Pisces alongside Jade Sleet; Unit 42 uses Slow Pisces
Sponsorship and objective North Korean cryptocurrency theft, attributed by the FBI; CrowdStrike classifies Pressure Chollima as state-sponsored and financially motivated
Historical boundary GitHub’s directly mapped campaign was public by 18 July 2023; older government reporting is contextual background, not a precise group formation date
Current incident coverage Read our separate Binance article
MITRE ATT&CK group identifier No group-level identifier is asserted in this profile; behaviour mappings appear below
Version 1, as of 30 October 2026

Naming is operationally significant. CrowdStrike says it designated Pressure Chollima separately on 14 January 2026, following separation from activity it had tracked under Labyrinth Chollima and Stardust Chollima. Its public profile lists Jade Sleet, Slow Pisces, UNC4899 and TraderTraitor among community identifiers. These are explicit cross-references by a named vendor, not a finding that every historical operation filed under those names belongs to an identical organisation.

Microsoft’s current naming table, retrieved on 30 October, still lists Storm-0954 and Labyrinth Chollima against Jade Sleet. That does not match the granularity of CrowdStrike’s newer segmentation. Retain both taxonomies with their source dates when searching historical reporting; do not overwrite the older label in original incident records. This profile uses the narrower Pressure Chollima / Jade Sleet pairing and retains TraderTraitor as its activity label.

There is a further historical trap. The 2022 joint US advisory used TraderTraitor for a series of malicious cryptocurrency applications built with JavaScript, Node.js and Electron. Later FBI statements use it for the associated threat activity. A malware-series name and an actor-tracking label are different kinds of claim. This profile therefore does not import an APT number, or every operation under the broad Lazarus label, into its current scope.

Context and operational character

The clearest recurring target is a trusted person who can reach something valuable. In GitHub’s July 2023 investigation, the actor cultivated employees through recruiter or developer personas, then encouraged execution of repositories containing malicious npm dependencies. GitHub described low-volume targeting of technology workers, many associated with cryptocurrency, blockchain or online gambling, and some in cybersecurity. It expressly said neither GitHub nor npm systems were compromised. The repository and package services were delivery channels in that campaign.

For scoping, distinguish the employer, the service provider and the eventual asset owner. They may be different organisations. A developer with no authority to approve a payment may still administer a service whose output another team trusts. TIR recommends drawing that dependency before reducing an intrusion to “a compromised laptop”. The useful inventory is the set of sessions, repositories, cloud roles and production interfaces reachable from that laptop, together with the approvals required to change each one.

The label “sophisticated” should describe evidenced choices. Unit 42’s April 2025 analysis found selective delivery: the malicious server could return ordinary data to unselected visitors while serving payloads to validated targets. Its Python chain used unsafe YAML deserialisation and delivered RN Loader and RN Stealer, with later tooling inferred to depend on the value of the victim. Unit 42 did not recover the complete JavaScript payload. It also explicitly distinguished these operations from other North Korean campaigns that use similar recruitment lures. A fake interview alone is not a sufficient attribution test.

Operations timeline and attribution strength

Entries marked 2026 addition are developments after 13 March included in this version. Incident dates, disclosure dates and confidence belong in separate fields.

Period Evidence and scope Attribution boundary
18 July 2023 disclosure GitHub documented recruiter personas, repository invitations and malicious dependencies GitHub assessed a North Korean objective with high confidence and explicitly mapped Jade Sleet to TraderTraitor
Late March–late May 2024 FBI, Japanese police and US defence investigators described the Ginco employee compromise preceding the DMM Bitcoin theft Official attribution to North Korean TraderTraitor activity; transaction manipulation described as likely
Around 21 February 2025 FBI announcement: approximately $1.5 billion taken from Bybit FBI attribution to North Korea, specifically labelled TraderTraitor
6 March–18 April 2026; 2026 addition LayerZero’s investigation: developer compromise, cloud access and tampered verification data preceding the KelpDAO theft Its detailed attribution section gives CrowdStrike and Mandiant high confidence for North Korea, medium confidence for UNC4899
March–June 2026; 2026 addition SentinelOne’s September report: backdoors on an Indian IT-services engineer’s Mac Vendor-linked activity at a victim without cryptocurrency ties; initial delivery unproven
July activity, disclosed 8 October 2026; 2026 addition Zscaler’s Terraform-provider investigation Substantial tactical and targeting overlap; insufficient unique links for independent high-confidence attribution

Technical analysis: from access to trusted transactions

The DMM case is particularly instructive. Investigators describe a recruiter approaching a Ginco employee in late March 2024 with a malicious Python employment test. After mid-May, the attacker used session-cookie information to impersonate that employee inside Ginco’s communications system. Investigators assessed that this access was probably used to alter a legitimate DMM transaction request in late May. The resulting theft was 4,502.9 bitcoin, valued at $308 million at the time. The account identifies both a technical credential path and a business-process manipulation; it does not establish that every later theft used the same mechanism.

LayerZero’s May 2026 report supplies a different transaction-integrity failure. It describes an initial developer compromise on 6 March, session-key use against cloud infrastructure from 30 March, and manipulation of remote procedure call (RPC) data. On 18 April, denial of service against external RPC providers left the verifier relying on poisoned internal sources. The report says the affected application’s single-verifier configuration accepted the resulting attestation, enabling the loss of 116,500 rsETH, approximately $292 million. Its detailed findings say signing keys were not compromised and that investigators found no key-exfiltration evidence. This is the provider’s forensic account; its medium-confidence attribution to the specific cluster must accompany the stronger country-level judgement.

The analytical connection is authority exercised on false or attacker-controlled inputs. TIR recommends testing the boundary immediately before signing: what establishes that a request is legitimate, which independent source can disagree, and whether degraded service silently reduces that independence. Cryptographic validity should be recorded as one property of a transaction, separately from the business decision to authorise it. A signature alone cannot answer the latter question.

Zscaler’s investigation of 8 October extends the developer-tooling concern. It describes a trojanised Terraform provider that retains ordinary provider behaviour while initiating payload delivery, with FLATROOF and ROOFDECK variants and support for multiple operating systems. The report leaves delivery to the victim unresolved. Crucially, its attribution section says tactical overlap is substantial but unique code, infrastructure or cryptographic links are insufficient for an independent high-confidence TraderTraitor attribution. Hunt the behaviour without converting the suspected relationship into a confirmed campaign membership.

Persistence and dwell time

SentinelOne’s additional victim gives unusually useful boundaries: backdoors were present by 18 March 2026; first observed execution followed on 29 March; a replacement implant appeared on 20 April; the final observed beacon was on 1 June. The vendor could not prove delivery. It observed execution associated with Cursor sessions before the replacement and later intermittent beaconing. These are measurements from one endpoint, not a standard TraderTraitor dwell time, nor proof of uninterrupted control throughout the interval.

For an investigation, preserve at least four clocks: earliest confirmed compromise, first credential use, first consequential change and last observed attacker activity. Also record the telemetry’s beginning and end. A long gap between events can mean inactivity, missing collection or an unobserved alternate channel. Do not silently choose one explanation. A binary moved to the bin, a stopped beacon or a rebuilt endpoint should each trigger a verification question about remaining access, rather than become the incident’s assumed end date.

Read the separate Binance article for our current incident coverage.

Indicators and behaviour mappings

These are historical hunting examples. Revalidate relevance before blocking; a matching filename alone does not establish compromise.

Indicator Published context
02df07a173ab03b82a4fb6a08973fff8b1467f28 SHA-1: FLATROOF in SentinelOne’s additional-victim case
5728b11d30586bbfc1d8bd12df1c722a06e767a2 SHA-1: replacement ROOFDECK in the same case
grenight[.]com Command-and-control domain in that case

The indicators above come from SentinelOne’s published table. Command and control is abbreviated C2 below. The mappings are TIR’s interpretation of observed behaviour against MITRE ATT&CK, not independent actor attribution.

Reported behaviour ATT&CK mapping Scope
Session-cookie impersonation in the FBI’s Ginco account T1550.004: Web session cookie Use of an existing authentication artefact; not proof of password theft
ROOFDECK Launch Agent persistence in LayerZero’s malware analysis T1543.001: Launch agent Reported macOS capability; not a claim that every affected endpoint used it

Detection and hunting guidance

Build the hunt around a causal chain. Start with a suspicious project or process, identify the user’s available sessions, then ask whether those sessions reached an administrative or transaction-producing service. Preserve repository revisions, dependency manifests, installation logs and process ancestry together. A finding should say which link is observed and which remains a hypothesis; a list of coincident alerts is not yet a reconstructed intrusion.

GitHub’s advisory recommends examining repository invitations, newly published dependencies and installation scripts that make network connections. Apply that advice to the relevant historical campaign, and test comparable checks in your own tooling before making them blocking controls. Legitimate engineering creates unusual processes and contacts new services. Require context such as an unsolicited recruitment approach, an unapproved package source, an unexpected executable and subsequent credential use to raise confidence.

For the authentication branch, MITRE’s session-cookie guidance explains that a valid session can provide access without another authentication challenge. TIR recommends correlating session activity with device identity and privilege changes, then asking whether the same credential was used after the endpoint was isolated. For macOS persistence, MITRE’s Launch Agent guidance supports monitoring relevant property-list changes and the associated execution. Record the approved baseline so legitimate launch items do not overwhelm the investigation.

Incident response and mitigation priorities

Treat identity containment and transaction containment as parallel work. Isolate the suspected endpoint while preserving the evidence needed to scope it; revoke exposed sessions and examine credentials reachable from it. Where an attacker may have reached a signing workflow, have the responsible treasury or service owner restrict that workflow using a tested emergency procedure. Avoid assuming that a stopped malware process reverses changes already made through legitimate administrative interfaces.

Re-establish trust through explicit checks. Identify who can modify destinations, policies, verification inputs and signer configuration. Test whether two approvals depend on the same workstation, data source or administrator. Require a clean path for emergency revocation and recovery, with named owners and a record of what was changed. These are TIR recommendations.

Keep external interview exercises away from production-bearing identities and environments. Review provider and dependency provenance before execution, and make it easy for staff to report suspicious recruitment without being blamed for engagement. Validate detection with harmless simulations of the relevant sequence: an unapproved project, unexpected child process, access to test credentials and a denied administrative action. Success means the team can connect those stages and act within its stated containment target, not simply generate an alert for each one.

Historical context and outlook

The FBI’s Bybit announcement describes rapid conversion and distribution of stolen assets across many addresses and blockchains. That financial activity is a separate investigative workstream from host forensics. Preserve transaction identifiers and asset movements alongside the internal timeline, without treating a freeze, a trace or an asserted balance as recovered funds.

We assess continued targeting of developer-to-production trust paths as likely (B2), given the separately documented recruiter, session and developer-tool cases above. The practical watchpoints are changes in reachable privileges, delivery tooling and transaction approval boundaries. This assessment does not predict a particular victim or imply that every such compromise leads to cryptocurrency theft.

Nor does persistent access at an IT-services firm establish cyberwarfare pre-positioning. That would require additional evidence of tasking, selected infrastructure, retained access or operational preparation serving that purpose. For this profile, retain financial theft, supplier access and opportunistic discovery as distinct hypotheses. The TIR trusted-access analysis offers related reading on dependency and containment questions; it is not evidence that those incidents share an operator.

Version history

Version 1, 30 October 2026: establishes the current Pressure Chollima / Jade Sleet profile, preserves source-specific naming differences, and adds the 2026 persistence and developer-tool evidence. Future revisions should distinguish a change in the evidence from a change in a vendor’s taxonomy.

Further reading