TraderTraitor aimed fake job offers at the engineers who hold the keys
An April 2022 federal advisory described North Korean operators courting crypto-firm engineers with fake recruiting and trojanized apps. For any financial firm, a job approach reaches the people with the most access through a channel security rarely watches, so controls must assume one will succeed.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On April 18, 2022, the FBI, CISA and the Treasury Department issued a joint advisory on North Korean state-sponsored activity against blockchain and cryptocurrency companies. Targets included exchanges, decentralized finance protocols, crypto gaming companies and venture capital firms. The advisory described the Lazarus Group sending large numbers of spear-phishing messages to employees, often in system administration or software development roles, through several communication channels and frequently disguised as recruitment for well-paid jobs. Recipients were encouraged to download trojanized cryptocurrency applications, which the advisory called TraderTraitor. Four days earlier, the FBI had attributed the theft of roughly $620 million in cryptocurrency from the Ronin network, which supported a popular blockchain game, to North Korean actors. Treasury added an address used in the theft to its sanctions listing for the group.
Most phishing defenses assume a familiar pattern: an unexpected message, often impersonating a colleague or supplier, asking the recipient to click a link or open a file. TraderTraitor used a different pretext. It approached engineers and administrators as job candidates, offering attractive roles and drawing them into conversations over days or weeks, often on professional networking sites and messaging apps. The payload arrived as a step in what looked like a normal hiring process. The campaign targeted crypto firms, but the method fits any institution whose engineers hold valuable access, including banks, payment processors and fintechs. Approaches like this will sometimes succeed, however good the training. The useful question is how far one success can reach. We look at three parts: the lure, the target and the controls that limit the damage.
The lure
Recruitment works as a pretext because it is personal, flattering and private. An engineer exploring a new job is unlikely to forward the conversation to their current employer’s security team. The exchange may happen on a personal phone or account. Requests that would seem odd from a stranger, such as downloading an application to complete a technical exercise or reviewing a code sample, look routine in a hiring process.
That means email filtering and standard awareness training cover only part of the risk. The approach may never touch corporate email. The engineer may still run the file on a work laptop, because that is where their development tools are. Training that names recruitment lures explicitly, with real examples, helps. So does a reporting route that carries no embarrassment. An employee should be able to say “a recruiter sent me something odd” without implying they are leaving. Thanking reporters and keeping their reports confidential makes the next report more likely.
The target
The advisory noted that the campaign aimed at people in system administration and development roles. The choice is deliberate. Those people reach production systems, cloud consoles, code repositories, build pipelines and, at crypto firms, the systems that hold or sign for digital assets. Compromising one of their machines can lead directly to the most valuable assets in the firm.
In crypto businesses, the stakes are stark because stolen assets can move irreversibly within minutes. Later reporting indicated that the Ronin theft rested on the compromise of private keys used to approve transactions. The logic carries over to conventional finance. An engineer with access to payment release systems, a database administrator for core banking or a cloud administrator with broad rights is a high-value target for any well-resourced adversary. A recruitment approach is a cheap way to reach them.
Firms rarely know which employees are being approached. A short, periodic exercise helps: list the people whose single compromised device could move money, change production code or read sensitive data in bulk. That list defines who needs the strongest controls and the most specific training. In most firms it is short enough to manage individually.
The controls that limit the damage
The first set of controls separates everyday work from privileged work. Workstations used by engineers and administrators can block unapproved software, with a fast path for legitimate requests so developers do not route around the rule. Privileged actions can require a separate hardened device or a managed privileged session. Then a compromise of the laptop used for email, browsing and side projects does not expose production credentials.
Monitoring adds a layer behind those barriers. Endpoint tools on engineering machines can flag newly installed applications that are unsigned or rare across the firm, and outbound connections to infrastructure never seen before. A trojanized trading or wallet application installed by one developer stands out against a fleet where nobody else runs it. That signal is cheap to collect and is most useful when someone reviews it daily.
The second set removes single points of failure. Signing keys, wallet controls and high-value payment releases can require approval from several people on separate devices, so that no one compromised machine can move assets. Code changes to payment or settlement systems can require review by a second engineer and deploy only through a pipeline that records who approved what. These controls cost speed, and teams resist them during urgent releases. Defining narrow, logged exceptions in advance keeps them in place when pressure rises.
The third set is response. If an engineer reports running a file from a recruiter, the security team should treat it as a possible compromise of everything that engineer can reach. That means a playbook to isolate the device, rotate credentials and keys, review recent privileged activity and check repositories and pipelines for changes. The faster a report arrives and is acted on, the less an intruder can do with the access.
Hiring runs in both directions. Financial firms also receive applications, and the same state has used fake candidates to seek remote technical jobs. Identity verification for new hires, especially remote ones, and staged grants of privileged access during onboarding protect against that reverse route.
With hindsight
North Korean operations against the crypto industry kept growing. In February 2025, the FBI attributed the theft of about $1.5 billion in digital assets from the exchange Bybit, one of the largest thefts on record, to the same TraderTraitor activity. Fake recruiting remained a common technique against developers. The reverse pattern also became a major concern. From 2024, the Justice Department brought a series of cases against schemes that placed North Korean IT workers in remote jobs at US companies under false identities, with revenue flowing to the North Korean state. Financial firms responded with stronger identity checks in hiring, hardened privileged access and multi-party approval for asset movements. By this point in 2026, recruitment-based social engineering and fraudulent candidates are standard topics in financial sector threat briefings. The firms that fared best had assumed an approach would eventually succeed and limited what one compromised engineer could do.