TraderTraitor (Jade Sleet) threat actor profile: how it reaches developers, sessions and signing flows

TraderTraitor is the North Korean cluster that US and Japanese authorities have tied to some of the largest cryptocurrency thefts on record, and it gets in through developers rather than through firewalls. The FBI attributes the roughly USD 308 million DMM Bitcoin theft (May 2024) and the roughly USD 1.5 billion Bybit theft (February 2025) to it. Its pattern is consistent across the public reporting: a convincing recruiter or collaborator persona, a coding task or repository that runs code on the target's machine, then reuse of that person's sessions and credentials to tamper with a transaction or the software that builds it. This profile is for security teams at exchanges, wallet and custody providers, Web3 and fintech firms, and the software vendors that serve them. It stays with what the FBI, Microsoft and GitHub have published, maps it to MITRE ATT&CK, and spends most of its length on detection and prevention. The wider North Korean picture is in the Lazarus Group Threat Actor Profile.

Key takeaways

• The entry point is a person, not a server. GitHub and the FBI describe fake recruiters and developers who persuade employees to run a repository, npm package or Python "pre-employment test".
• Identity is the real target. In the DMM case the FBI says the actors used stolen session cookie information to impersonate an employee; in the Bybit case a developer's AWS session tokens were used. MFA at login did not help once a valid session was in hand.
• The theft happens in someone else's workflow. Both large cases ended with a legitimate transaction being altered upstream, at a wallet software supplier, rather than with keys being exfiltrated from the victim exchange.
• Several employees are worked at once. The FBI notes the group often targets multiple employees of the same company in parallel, so one reported lure means others are likely live.
• Developer workstations are now crown jewels. Any laptop that can reach production cloud consoles, signing services or transaction tooling needs the controls you would give a privileged access workstation.

Who they are (names and aliases)

The names below come from the reporting organisations themselves. Naming conventions differ by vendor and clusters do not map perfectly; treat the aliases as overlapping tracking labels, not proof that every activity under one name was the same team.

ATT&CK v20 has no separate group entry for TraderTraitor; the related North Korean clusters sit under Lazarus Group and APT38. See the APT38 Threat Actor Profile Guide for the bank-theft lineage and the Contagious Interview Threat Actor Profile Guide for a separate fake-interview campaign that is easy to confuse with this one.

Targeting and motivation

The motive is revenue for the North Korean state. GitHub's July 2023 alert says the group mainly targets people linked to cryptocurrency and blockchain organisations, and also the vendors those firms use, with some targets in online gambling and a few in cybersecurity. The FBI's September 2024 warning on North Korean social engineering of the crypto industry adds that actors had been researching companies tied to cryptocurrency exchange traded funds and similar products, which it read as preparation for future attacks.

• Direct targets: exchanges, custodians, DeFi projects and treasury teams that move large balances.
• Indirect targets: wallet software providers, multisig interface providers and enterprise wallet vendors. Ginco (DMM Bitcoin) and Safe{Wallet} (Bybit) were both one step removed from the firm that lost the funds.
• People: developers and engineers with access to code, cloud consoles or transaction tooling, approached through their professional profiles.

How the intrusions unfold

The two cases below are the best documented. The facts are from the FBI release and FBI public service announcement, and for Bybit from the NHI Mgmt Group breach analysis, which cites Safe{Wallet}'s and Sygnia's findings.

The full Bybit chain is in Bybit Hack 2025: How One Developer's AWS Session Tokens Enabled a $1.5 Billion Theft. GitHub's 2023 alert documents the earlier, wider campaign: personas on GitHub, LinkedIn, Slack and Telegram (some of them taken-over real accounts), invitations to collaborate on a repository, and malicious npm dependencies used as a first stage that pulls a second stage. GitHub observed that the packages were often published only when the invitation was sent, which shortens the window for anyone to spot them.

Tactics and techniques (MITRE ATT&CK)

The mapping below is NHI Mgmt Group's reading of the behaviours described by the FBI and GitHub. It is not a MITRE group entry. Every ID was checked against ATT&CK v20.

Where identity fits

Strip away the cryptocurrency and this is an identity attack chain. The human identity (the developer) is socially engineered; the non-human credentials on that person's machine (cloud session tokens, collaboration session cookies, Git credentials, package publishing tokens) are what the actor actually uses; and the system that is finally abused is a machine workflow that trusts whatever request arrives with a valid session.

• Session tokens outlive MFA: a token issued after a strong login is still a bearer credential. Short session lifetimes, device binding where the platform supports it, and re-authentication for sensitive actions shrink the value of a stolen session. See the Infostealer Logs and Session Token Abuse Guide.
• Developer credentials reach production: a human with standing write access to the bucket that serves a signing interface is a single point of failure. Federated, short-lived, just-in-time access for deployment, with deployment through a pipeline rather than a laptop, removes the standing path.
• Transaction services are non-human identities too: the services that build, approve and sign transactions need their own scoped identities and logs, not shared operator sessions. See the Crypto Exchange Identity and Key Security Guide.

Detection and defence

Prevention

1. Forbid running candidate or partner code on company devices. The FBI's September 2024 PSA advises against running pre-employment tests or code on company devices and recommends a virtual machine on a separate device when execution is unavoidable. Make this policy, give engineers a disposable sandbox, and tell recruiters and hiring managers.
2. Verify identity out of band. Confirm any recruiter, collaborator or "known contact" through a separate channel before acting on a request to install, clone or run anything (FBI).
3. Harden dependency installs. GitHub advises scrutiny of install scripts, newly published packages and packages that make network connections during installation. Disable lifecycle scripts by default for ad hoc installs (npm supports --ignore-scripts) and route installs through an internal registry proxy with an age or allowlist policy.
4. Separate the signing path from daily work. Keep wallet secrets off internet-connected devices and require multiple approvals from separate devices and networks before moving assets (FBI). Display and verify the full transaction payload on the signing device, not only in a web interface.
5. Remove standing write access to transaction tooling. Deploy interface code through a reviewed pipeline with integrity checks, so a single stolen developer session cannot change what signers see.
6. Apply allowlisting where the money is. The FBI recommends allowing only approved programs on network devices at firms holding large cryptocurrency balances.

Detection

Response

If a lure was followed, the FBI advises disconnecting the device from the internet while leaving it powered on to preserve evidence, saving screenshots and identifiers of the conversation, and reporting to IC3. GitHub advises resetting or wiping the device and rotating every credential and token that was on it. Revoke active sessions at the identity provider and cloud provider, not only passwords, and assume colleagues were approached at the same time. The Identity Incident Response Playbook covers session and token revocation order.

Metrics

• Standing production write access: number of human identities with direct write access to signing or transaction interface hosting (target: zero outside break-glass).
• Session lifetime: maximum cloud console and CLI session duration for engineers with production roles.
• Sandbox use: proportion of external code reviews or interview tasks run in the approved sandbox rather than on managed laptops.
• Time to revoke: time from a reported lure to revocation of all sessions and tokens for that user.
• Install-script exposure: share of developer installs that run through the internal registry proxy.

Common failure patterns

• Treating it as a recruitment scam: the lure looks like a hiring problem, so it is reported to HR, not security, and the token rotation never happens.
• Trusting MFA after login: controls stop at sign-in while session tokens on the laptop remain valid for hours. The Bybit chain is the clearest example.
• Supplier blind spot: exchanges harden their own estate while the wallet or interface vendor that builds their transactions is assessed only by questionnaire.
• Personal and work accounts mixed: in the DMM case the test code moved through the employee's personal GitHub, outside corporate logging.
• Single-channel verification: approving a transaction on the same web interface that may have been altered, with no independent check of the payload.
• One victim assumed: responders clean one laptop without checking whether other staff received the same approach.

Framework mapping

Practitioner checklist

• Publish a rule that no external code, test or repository is run on a managed device, and provide a disposable sandbox.
• Brief engineering, recruiting and treasury staff on the lures in GitHub's and the FBI's advisories.
• Search the GitHub security log for repo.add_member events from unknown accounts.
• Cap session lifetime for production roles and require re-authentication for sensitive cloud actions.
• Remove standing human write access to anything that serves or signs transactions; deploy through a reviewed pipeline.
• Verify every transaction payload on an independent device before approval.
• Route developer package installs through an internal proxy and disable install scripts for ad hoc use.
• Add wallet and interface suppliers to supplier risk reviews that ask about their developer access model.
• Pre-agree the response: isolate but keep powered on, revoke all sessions and tokens, check colleagues.

Standards and references

• FBI: FBI, DC3, and NPA Identification of North Korean Cyber Actors, Tracked as TraderTraitor, Responsible for Theft of $308 Million USD from Bitcoin.DMM.com
• FBI IC3: North Korea Responsible for $1.5 Billion Bybit Hack
• FBI IC3: North Korea Aggressively Targeting Crypto Industry with Well-Disguised Social Engineering Attacks
• GitHub: Security alert: social engineering campaign targets technology industry employees
• Microsoft: How Microsoft names threat actors
• MITRE ATT&CK: Steal Web Session Cookie
• MITRE ATT&CK: Compromise Software Dependencies and Development Tools
• NIST: Cybersecurity Framework 2.0

Related NHI Mgmt Group resources: Lazarus Group Threat Actor Profile, Developer Workstation and IDE Security Guide, Crypto Wallet Security Guide, Insider Threat from Fake IT Workers Guide (North Korean IT Worker Schemes).