Skip to content
Start with Identity
Join free
Threat actor · Nation-state · MITRE ATT&CK G0032

Lazarus Group and TraderTraitor identity breaches

Lazarus Group is a North Korean state-sponsored threat group that MITRE ATT&CK tracks as G0032 and says is attributed to the Reconnaissance General Bureau (RGB). TraderTraitor is a cryptocurrency-focused North Korean cluster. Mandiant says its UNC4899 likely corresponds to TraderTraitor, assesses with high confidence that UNC4899 is an RGB element, and notes that RGB-aligned crypto groups are publicly reported under the umbrella term Lazarus. MITRE does not list TraderTraitor as a Lazarus alias, so this page groups them as reported, not as one confirmed unit. The FBI said North Korea was responsible for the theft of about $1.5 billion from Bybit on or about February 21, 2025, and called the activity TraderTraitor. The records here share a pattern: an employee or developer machine or account is compromised first, then keys, sessions or signing access are used to move funds.

Also tracked as
TraderTraitor, UNC4899, Lazarus Group, Diamond Sleet, HIDDEN COBRA
Origin (as attributed)
North Korea: Lazarus Group is attributed to the Reconnaissance General Bureau (MITRE ATT&CK); the FBI attributes TraderTraitor activity to North Korea
MITRE ATT&CK
G0032
Profile verified
Nov 5, 2026
3
incidents in the database, disclosed 2022-2026
1 / 0
MFA bypassed / not enforced (2 not applicable or undisclosed)
67%
began with stolen credentials
2 / 1
human / non-human identity abused

Incidents attributed to Lazarus Group and TraderTraitor

Records whose sources attribute the intrusion to this group or one of its tracked names, newest disclosure first. Each record links its primary sources.

Browse the full database

Identity techniques used

Identity controls that failed

How to defend against Lazarus Group and TraderTraitor

One control per initial access vector seen in this group's records, most frequent first. The identity lesson on each incident page gives the case-specific detail.

  1. Stolen credentials (2 of 3): Assume passwords leak: enforce phishing-resistant MFA on every account, watch for infostealer exposure of employee credentials, and revoke sessions when a credential is reported stolen. See Infostealer credential harvesting and Infostealer.
  2. Session or token theft (1 of 3): Bind sessions and tokens to the device that earned them so a copied cookie or token fails elsewhere, and shorten session lifetimes for privileged access. See Token replay, Device-bound session credentials and Proof of possession.

Sources

  1. Lazarus Group, Group G0032
  2. North Korea Responsible for $1.5 Billion Bybit Hack (FBI IC3 PSA, 2025-02-26)
  3. North Korea Leverages SaaS Provider in a Targeted Supply Chain Attack (Mandiant, 2023-07-24)

Profile verified Nov 5, 2026 against the sources above. Incident attributions come from each record's own sources. Corrections: contact us.

Frequently asked questions

Which breaches has Lazarus Group and TraderTraitor been linked to?
The Identity Breach Database attributes 3 identity breaches disclosed 2022-2026 to Lazarus Group and TraderTraitor: Binance wallet theft through compromised engineers and a standing deployment token (2026), Bybit cold-wallet theft via hijacked Safe{Wallet} developer AWS sessions (2025) and Ronin bridge theft via compromised validator keys (2022). Attribution follows each record's sources; where the actor name is only claimed, the record says so.
How does Lazarus Group and TraderTraitor get initial access?
Across its 3 records, the initial access vectors were stolen credentials (2) and session or token theft (1). The identity control that failed most often was credential storage (1 of 3).
Did MFA stop Lazarus Group and TraderTraitor?
In 1 of 3 incidents MFA was present and bypassed, and in 0 it was not enforced on the abused account. In the remaining 2, MFA was not applicable (no interactive login, such as a stolen key or token) or its status was not disclosed. 1 of the incidents abused a non-human identity, where user MFA does not apply.

Cite this page

SWI Community Team. (2026). Lazarus Group and TraderTraitor identity breaches. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/actors/lazarus-tradertraitor/

Part of the Identity Breach Database, free to reuse under CC BY 4.0. See all threat actors.