TraderTraitor
TraderTraitor is a North Korea-linked, state-backed threat actor tracked as UNC4899 and also referred to in the provided content as Jade Sleet, Slow Pisces, and a subgroup or subset of the Lazarus Group. The actor is repeatedly associated with cryptocurrency and DeFi theft, laundering, and intrusion activity targeting exchanges, bridges, wallet infrastructure, blockchain service providers, and related cloud and Kubernetes environments. In the provided reporting, TraderTraitor is attributed with high confidence by LayerZero, Mandiant, and CrowdStrike to the April 2026 KelpDAO / LayerZero rsETH bridge exploit, in which approximately $292 million was stolen after compromise of infrastructure involved in cross-chain message verification. Reported tradecraft included social engineering of a developer, use of malware on macOS, theft of session keys, access to RPC infrastructure, poisoning of internal op-geth / RPC nodes, DDoS against external RPC providers to force failover, and causing a verifier to sign a forged message. The actor then used stolen rsETH as collateral on Aave to borrow real assets, and laundered proceeds through THORChain, Wasabi, Tornado Cash, and Umbra. The content also states that TraderTraitor was tied to the February 2025 Bybit Safe{Wallet} theft of roughly $1.5 billion in Ethereum, and references links to other cryptocurrency theft activity including BTCTurk and a parallel Drift-related context, though one source notes Drift may have involved a distinct North Korean group. The content describes TraderTraitor using patient social engineering and phishing, including approaches to employees via LinkedIn and Telegram, as well as malware-laced repositories or archives disguised as open-source collaboration. Reported post-compromise behavior includes harvesting cloud or session tokens, pivoting into cloud environments, reconnaissance of Kubernetes clusters, theft of high-privilege CI/CD service account tokens, lateral movement, persistence, compromise of systems containing customer information and credentials, and theft of digital assets. The FBI reporting in the content specifically identifies TraderTraitor as a North Korean actor and urges exchanges, bridges, RPC node operators, blockchain analytics firms, DeFi services, and other virtual asset service providers to block transactions involving Ethereum addresses used by the group to launder stolen assets. Known aliases in the provided content: UNC4899, Jade Sleet, Slow Pisces, and TraderTraitor. The content also places the actor within or under the broader Lazarus Group.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Financial Services
Where they're from
Attributed origin per open-source reporting.
- KP
Tradecraft
57 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
27 malware families attributed to this actor across reporting.
22 additional families tracked in Mallory.
Observables
79 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Attributed as the DPRK-linked actor behind the April Kelp DAO/LayerZero bridge exploit and tied to a parallel major crypto heist; the group laundered stolen funds through THORChain, Wasabi, Tornado Cash, and Umbra.
Attributed with high confidence to the six-week compromise and exploit of the KelpDAO rsETH bridge, involving social engineering of a developer, malware deployment on macOS, theft of session keys, access to LayerZero RPC infrastructure, malicious modification of op-geth on Kubernetes clusters, and forged bridge attestations that enabled release of approximately $292M in rsETH.
Referenced in connection with the LayerZero Labs KelpDAO incident report.
North Korean threat group conducting major cryptocurrency theft operations against crypto exchanges and DeFi infrastructure, including the ByBit and Kelp incidents.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.