TraderTraitor: $8.57 billion in thefts and attack methods on crypto

The North Korean group TraderTraitor has stolen $8.57 billion over 20 months in six attacks on crypto exchanges and bridges.

The largest hack occurred at Binance, with damages estimated at $6.36 billion. This is the most massive theft in the history of the cryptocurrency market.

Since February 2025, hackers have used social engineering methods and infrastructure compromise, avoiding smart contract vulnerabilities.

• Hacking developers' and DevOps specialists' computers
• Phishing job offers from recruiters
• Compromise of RPC nodes and use of zero-day exploits

Analyst ZachXBT confirmed the link between incidents through on-chain data, finding funds from Binance and Bitget at a single THORChain address.

The main method for returning funds is blocking stablecoins by issuers. Of the frozen Binance assets, about 42% ($2.7 billion) was successfully blocked.

The situation at Bitget proved critical: the hacker exchanged assets in 41 minutes, stopping only 0.2% of the funds. Excluding Binance, only 5% of the stolen amount was frozen.