Home › Threat Actors › Lazarus Group (TraderTraitor / APT38 / UNC4736)
← All Threat Actors
Nation-State critical North Korea (DPRK)

Lazarus Group (TraderTraitor / APT38 / UNC4736)

North Korean state-sponsored (RGB — Lazarus sub-cluster) · Financial theft / cryptocurrency theft / sanctions evasion

Reports 1
Active Since 2018
Last Reported 28 May 2026
Sectors Targeted finance, communications, critical-infrastructure

Tactics, Techniques & Procedures (TTPs)

  • TraderTraitor: LinkedIn and Telegram fake job offer social engineering targeting developers at crypto exchanges
  • Trojanised developer tools, malicious npm and PyPI packages for supply chain compromise
  • Safe{Wallet} developer device compromise to inject malicious JavaScript into multisig wallet interface (Bybit, Feb 2025)
  • AppleJeus macOS malware family for cryptocurrency platform targeting
  • GitHub repository social engineering and fake open-source project contributions
  • SWIFT financial messaging system compromise (APT38 historical, BankBotABE/DYEPACK malware)

Known Targets

Cryptocurrency exchanges (Bybit — $1.5B theft, Feb 2025)DeFi protocols and blockchain platformsCrypto wallet and custody solution developersBanks using SWIFT messaging (APT38 legacy)Venture capital firms investing in digital assets

Analyst Notes

This tracking cluster combines overlapping Lazarus sub-designations: APT38 (financial crime wing focused on SWIFT and banking); UNC4736/TraderTraitor (developer supply chain and cryptocurrency theft). The February 2025 Bybit theft — $1.5 billion, the largest single cryptocurrency theft on record — was executed via compromise of a Safe{Wallet} developer machine, injecting malicious JavaScript into the multisig wallet interface that transparently substituted attacker-controlled addresses during signing. The attack required no access to Bybit systems directly. Estimated $3B+ stolen in cryptocurrency since 2017; proceeds fund North Korean weapons programmes. See also: Lazarus Group (parent cluster profile).

Also Known As

TraderTraitorAPT38UNC4736Sapphire SleetBlueNoroffStardust Chollima

MITRE ATT&CK Techniques

T1566.003 Phishing: Spearphishing via Service T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1204.002 User Execution: Malicious File T1657 Financial Theft T1071.001 Application Layer Protocol: Web Protocols

Intelligence Reports

Analysis financecommunications

Lazarus Group / TraderTraitor: North Korea's Premier Financial Theft Operation

A comprehensive profile of Lazarus Group and its TraderTraitor subcluster -- the North Korean cyber apparatus responsible for over $6 billion in cryptocurrency theft, the largest single financial heist in history, and a growing campaign of developer-targeted supply chain intrusions.

28 May 2026 · 12 min read