kyber.today

daily cyber × ai intelligence

← threat actors

threat actor · KP

TraderTraitor

also tracked as jade sleet 3, contagious interview 1, unc4899 1, trader traitor 1, citrine sleet 1, cryptocore 1, famous chollima 1, lazarus group 1, moonstone sleet 1, temp hermit 1

related, not merged: Lazarus Group 18

7 stories · 5 in the wild · September 9, 2026 – November 8, 2026

evidence: 5 observed · 1 claimed

how they got in

  • supply chain 2 · Oct 10
  • fake recruiter 1 · Nov 8
  • stolen credentials 1 · Nov 1
  • insider 1 · Oct 31

sectors

  • finance 4 · Nov 8
  • crypto 4 · Nov 2
  • technology 1 · Sep 22
  • defense 1 · Sep 9
  • government 1 · Sep 9

geography

  • north korea 3 · Nov 1
  • india 1 · Sep 22

malware and tools

  • flatroof 1 · Sep 22
  • roofdeck 1 · Sep 22

techniques

  • supply chain 3 · Nov 8
  • fake recruiter 1 · Nov 8
  • credential compromise 1 · Oct 31
  • trojanization 1 · Oct 10

attack phases seen

  • Initial access 5 · Nov 8
  • Execution 2 · Oct 10
  • Persistence 1 · Nov 8
  • Impact 1 · Nov 2

what we reported, newest first, grouped by story

Oct 30 – November 8, 2026 · 4 reports

  • New profiling separates TraderTraitor from higher-volume job-lure crews. Security Alliance argues that TraderTraitor/Jade Sleet/UNC4899 uses fake interviews as an entry point but differs from Contagious Interview through careful target selection, multi-employee pressure and infrastructure-focused operations involving front-company repositories and trojanized Terraform providers. Binance still has not released meaningful technical indicators (earlier coverage). · Nov 8 · observed · via fake recruiter · as jade sleet, unc4899, contagious interview · Threat Activity & Operations
  • Chainalysis adds on-chain detail to the Binance theft: an attacker linked to TraderTraitor moved about $6.4B from hot wallets across multiple blockchains on October 29, attempted to outrun stablecoin freezes, and laundered funds through highly automated, patterned transactions with on-chain links to September's Bitget exploit. The FBI's advisory lists 628 addresses — 608 Ethereum, 19 Bitcoin, one Solana (Chainalysis, BleepingComputer, earlier coverage). · Nov 2 · observed · as trader traitor · Threat Intelligence
  • FBI names TraderTraitor for the Binance heist and publishes its Ethereum addresses (Catalin Cimpanu), matching TRM Labs' high-confidence attribution to the North Korean group behind the $1.5 billion Bybit theft in February 2025. Binance's preliminary finding, disclosed Oct 30, is that the attacker reached a service container via a compromised DevOps engineer's laptop, with no evidence of private-key leakage; roughly $3 billion is frozen on-chain, including 1.567 billion USDT by Tether and 800 million USDC by Circle (CyberInsider, The Hacker News). Binance's latest update says 90% of the $6.3 billion has been replenished (DarkWebInformer); vxunderground's early call that this would turn out to be mundane social engineering rather than a browser zero-day chain looks well aimed. Earlier coverage. · Nov 1 · observed · via stolen credentials · Threat Activity
  • Binance traced the $6.3 billion theft to a compromised DevOps engineer's laptop, which enabled unauthorized withdrawals; the exchange says no private keys leaked and user funds are covered. Roughly $3 billion is frozen on-chain, including 1.567 billion USDT by Tether and 800 million USDC by Circle. TRM Labs and other blockchain analysts attribute the operation to North Korea's TraderTraitor, making this the largest single crypto theft on record. Deposits resumed; withdrawals remain suspended pending a service overhaul (BleepingComputer, SecurityWeek); earlier coverage. · Oct 31 · observed · via insider · Threat Intelligence

October 10, 2026

  • Suspected TraderTraitor actors trojanized a Terraform provider to deliver cross-platform malware, per Zscaler ThreatLabz — though @malwrhunterteam disputes the "we uncovered it in July" framing, noting others had the sample publicly at the time. · Oct 10 · claimed · via supply chain · Supply Chain & CI/CD

September 22, 2026

  • Jade Sleet (aka TraderTraitor, UNC4899) is tied by SentinelOne to the compromise of a small India-based IT services provider, using macOS backdoors FLATROOF (aka Gaslight) and ROOFDECK — both Rust-based, ARM macOS, and previously seen in the March–April 2026 KelpDAO/LayerZero bridge attack. The lure is a job-interview coding project whose weaponised .terraform.lock.hcl points at registry.hashicorp-aws[.]com, so a developer running terraform init pulls attacker-controlled modules. The Hacker News · Sep 22 · observed · via supply chain · as jade sleet · Supply Chain & Developer Targeting

September 9, 2026

  • The Lazarus umbrella has been decomposed into six clusters. Kudelski Security and Sekoia map DPRK cyber capability onto TEMP.Hermit, Citrine Sleet, CryptoCore, Jade Sleet, Moonstone Sleet and Famous Chollima following a reorganization of the North Korean intelligence service two years ago, mixing espionage with crypto theft, ransomware and bank heists, and place each in the state structure (Kudelski Security). · Sep 9 · none · as lazarus group, temp hermit, citrine sleet, cryptocore, jade sleet, moonstone sleet, famous chollima · Threat Activity