The FBI, CISA, and US Treasury introduced the name TraderTraitor in an April 2022 advisory for a North Korean state-sponsored group active since at least 2020, overlapping with activity industry researchers track as Lazarus Group, APT38, BlueNoroff, and Stardust Chollima. Its hallmark technique is spearphishing employees of cryptocurrency exchanges, DeFi platforms, trading firms, and blockchain-gaming companies, often through fake recruiter outreach or bogus pre-employment coding tests, to deliver trojanized cross-platform cryptocurrency applications or malicious code copied into a victim's repository. These payloads can enable theft of private keys and fraudulent blockchain transactions. US authorities later attributed several major thefts to this activity, including the Harmony Horizon Bridge theft, the 2024 DMM Bitcoin exchange theft following a fake GitHub coding test sent to a wallet-software employee, and the February 2025 Bybit exchange theft. A joint FBI, DC3, and Japanese National Police Agency advisory also noted that the activity is tracked as Jade Sleet, UNC4899, and Slow Pisces.
KelpDAO / LayerZero
#KelpDAO • 2026-04
The April 18, 2026 KelpDAO exploit — resulting in approximately $290M in losses — was a sophisticated supply-chain-style RPC poisoning attack attributed to DPRK's TraderTraitor cluster, in which the threat actor compromised two independent RPC nodes used by LayerZero Labs' DVN, replaced their op-geth binaries with malicious versions that selectively forged transaction confirmations only to the DVN while reporting truthfully to all other observers, and simultaneously DDoS'd uncompromised RPC nodes to force failover onto the poisoned infrastructure — an attack that succeeded exclusively because KelpDAO's rsETH was configured with a single 1-of-1 DVN, eliminating any redundant verification that would have otherwise blocked the forged message.
-
24
Related Reports
-
1
Affected Countries
-
4
Months Since