Jade Sleet

Summary

RGB-directed cryptocurrency-theft and software-supply-chain operation tracked as TraderTraitor (FBI), Jade Sleet (Microsoft), UNC4899 (Mandiant/GTIG), PRESSURE CHOLLIMA (CrowdStrike, which split it out of LABYRINTH CHOLLIMA in Jan 2026) and Slow Pisces (Unit 42). It goes after developers and DevOps engineers at crypto firms — and, in 2026, their suppliers — through fake recruiter and coding-test lures, trojanized developer tooling and npm dependencies. The FBI attributed the ~$1.5B Bybit theft (Safe{Wallet} developer compromise, Feb 2025) to TraderTraitor; the FBI, DC3 and Japan's NPA attributed the ~$308M DMM Bitcoin theft (May 2024). 2026: SentinelLabs found its Rust backdoors FLATROOF and ROOFDECK on an Indian IT services provider (Mar–Jun 2026) delivered via weaponized Terraform interview projects; Mandiant and CrowdStrike link the ~$292M KelpDAO/LayerZero bridge theft (Apr 2026) to UNC4899 at medium confidence; Zscaler found a trojanized Terraform provider in July 2026 (suspected TraderTraitor). The ~$387M Bitget theft (24 Sep 2026) is DPRK-attributed by Chainalysis but not yet tied to a subgroup. Sapphire Sleet / UNC1069 (Axios, Mastra npm compromises) is a separate cluster — see BlueNoroff.

Attribution

No bureau named in the sources on file

Named by a government: indictment, sanctions designation, joint advisory or official statement.

• FBI (Government, 2025-02-26)
  Attributes the Bybit theft to North Korea's TraderTraitor activity
• Unit 42 (Palo Alto Networks) (Research, 2025-04-14)
  North Korean state-sponsored group

Campaigns 6

Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.

MITRE ATT&CK techniques 6

Malware and tools 5

Infrastructure patterns

• Fake developer and recruiter personas on GitHub and social media, plus malicious npm packages (GitHub, 2023)
• Trojanized Terraform providers served from HashiCorp lookalike registries (SentinelLabs, 2026)
• Nostr relays and an attacker-controlled Nostr profile locate its C2 (SentinelLabs, 2026)

Reporting and advisories 6

• GitHub Security
  GitHub repo-invitation social engineering with malicious npm dependencies
• FBI IC3 PSA I-022625-PSA
  Bybit Exchange Theft — Safe{Wallet} supply chain (TraderTraitor)
• Unit 42
  Slow Pisces — LinkedIn coding-challenge lures (RN Loader / RN Stealer)
• SentinelLabs
  Weaponized Terraform interview projects — FLATROOF / ROOFDECK on a non-crypto Indian IT provider
• LayerZero Labs incident report
  KelpDAO / LayerZero rsETH bridge theft (~$292M) — developer social engineering, poisoned RPC nodes
• Zscaler ThreatLabz
  Trojanized Terraform provider (terraform-provider-awsbeta) — cross-platform FLATROOF / ROOFDECK