TraderTraitor
TraderTraitor is a North Korean state-sponsored threat actor focused primarily on generating revenue for the DPRK regime by targeting the cryptocurrency and decentralized finance sector. The group is also tracked as Jade Sleet, Slow Pisces, UNC4899, and PUKCHONG, and multiple sources in the content describe it as a subgroup or subset of the Lazarus Group. Reported targeting includes cryptocurrency exchanges, DeFi platforms, virtual asset service providers, and cryptocurrency developers. The content describes TraderTraitor using social engineering extensively, including fake recruiter personas and approaches over LinkedIn and Telegram, as well as malicious coding challenges and trojanized GitHub repositories aimed at developers. Observed malware delivery and execution techniques include malicious npm and PyPI packages, unsafe PyYAML deserialization in Python projects, and JavaScript execution abuse through EJS rendering. Associated payloads and tooling described in the content include RN Loader, RN Stealer, and post-compromise malware used to steal credentials, cloud configuration, SSH keys, macOS keychains, browser data, and environment variables. The group is also described as using selective payload delivery, anti-analysis checks, memory-resident tooling, and operational patience. The actor is linked in the content to major cryptocurrency theft operations. The FBI attributed the February 2025 theft of approximately $1.5 billion in virtual assets from Bybit to TraderTraitor. Multiple reports in the content also attribute the April 2026 KelpDAO / LayerZero exploit, valued at roughly $292 million, to TraderTraitor / UNC4899 with high confidence, describing compromise of infrastructure involved in cross-chain verification and subsequent laundering through services including THORChain, Wasabi, Tornado Cash, and Umbra. The content also references TraderTraitor in connection with Safe{Wallet} compromise activity and broader DPRK supply-chain and infrastructure clusters, including overlaps or pivots to AppleJeus-related infrastructure. The group is described as laundering stolen assets across thousands of blockchain addresses and converting funds across chains and asset types. The FBI specifically called on RPC node operators, exchanges, bridges, blockchain analytics firms, DeFi services, and other virtual asset service providers to block transactions involving TraderTraitor-linked laundering addresses.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Software & Services
Tradecraft
59 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
30 malware families attributed to this actor across reporting.
25 additional families tracked in Mallory.
Observables
89 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
North Korea-aligned activity targeting cryptocurrency and decentralized finance organizations and developers using fake recruiter personas and malicious npm/PyPI packages.
Attributed as the DPRK-linked actor behind the April Kelp DAO/LayerZero bridge exploit and tied to a parallel major crypto heist; the group laundered stolen funds through THORChain, Wasabi, Tornado Cash, and Umbra.
Attributed with high confidence to the six-week compromise and exploit of the KelpDAO rsETH bridge, involving social engineering of a developer, malware deployment on macOS, theft of session keys, access to LayerZero RPC infrastructure, malicious modification of op-geth on Kubernetes clusters, and forged bridge attestations that enabled release of approximately $292M in rsETH.
Referenced in connection with the LayerZero Labs KelpDAO incident report.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.