2025-02-26 · day precision · report
FBI attributes the approximately $1.5B Bybit theft to TraderTraitor
Dated public source. This cell records publication, not the start of an attack.
· Source-attributed report · source published 2025-02-26
TraderTraitor
No sourced public emblem in this profile.
research profile · reported nexus: KP (not nationality)
The FBI uses TraderTraitor for specific North Korean cyber activity, including its attribution of the February 2025 Bybit theft. It is an activity label, not a verified roster of people. Related labels in the wider North Korean ecosystem are not interchangeable by default.
Source-reported aliases: Jade Sleet, UNC4899, Pukchong. Associations do not prove equivalence.
Kinwilder analysis
Keep attribution and transaction mechanics in different evidence columns. A transaction trace can establish effects without establishing an operator's identity; an agency attribution is a separately sourced assessment. For custody teams, the practical issue is independence of transaction interpretation, including the frontend, decoder, simulation service and implementation-change policy. Multiple keys can share a compromised meaning layer.
Target geography
Catalog-listed countries (associations, not attack counts): No country-level metadata
No bound claim-post feed for this label.
Historical casebook
2022-04-18 · day precision · report
CISA: TraderTraitor cryptocurrency-sector advisory
Dated public source. This cell records publication, not the start of an attack.
· Source-attributed report · source published 2022-04-18
2024-05 · month precision · incident
DMM Bitcoin theft
FBI, DC3 and Japan’s NPA attribute the May theft to TraderTraitor. Their account connects a recruiting pretext to a wallet-management trust boundary.
Japan · Joint agency attribution · source published 2024-12-23
2025-02-21 · day precision · incident
Bybit custody theft
FBI dates the theft to on or about 21 February and attributes the specific activity to TraderTraitor. Geography is not inferred from an exchange brand.
· FBI attribution; approximate day · source published 2025-02-26
Planned Kinwilder coverage
Tentative editorial review windows, contingent on evidence and review; not promised publication dates or predictions of attacks.
2026-10-27: One transaction, several meanings. Where can transaction intent change between a signer, a wallet service and the chain?
References
https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-108a
https://www.ic3.gov/PSA/2025/PSA250226
https://www.mandiant.com/resources/blog/north-korea-supply-chain
https://us-cert.cisa.gov/ncas/alerts/aa22-108a
https://www.mandiant.com/resources/blog/north-korea-cyber-structure-alignment-2023
https://cloud.google.com/blog/topics/threat-intelligence/cyber-threats-targeting-brazil