Incidents attributed to:
TraderTraitor targets blockchain companies through spear-phishing messages.
TraderTraitor targets blockchain companies through spear-phishing messages. The group sends these messages to employees, particularly those in system administration or software development roles, on various communication platforms, intended to gain access to these start-up and high-tech companies. TraderTraitor may be the work of operators previously responsible for APT38 activity.
Jade Sleet, UNC4899, Pukchong.
Actor metadata imported from Malpedia (Fraunhofer FKIE).
Cryptocurrency exchange Bitget said suspected North Korean attackers spoofed transaction data through a compromised backend to drain about $351.6 million from its hot and warm wallets.
Attackers stole about 116,500 rsETH (roughly $292 million) from Kelp DAO's LayerZero bridge by poisoning the RPC nodes behind a single-verifier setup; LayerZero attributed the theft to North Korea's Lazarus Group, specifically its TraderTraitor subgroup.
Lazarus operators substituted the implementation contract during a routine Safe multisig transaction, draining ~$1.5 billion in ETH and staked-ETH derivatives from Bybit's Ethereum cold wallet — the largest single cryptocurrency theft in history.