"TraderTraitor" is not a random name. It is the label the FBI and CISA use for a North Korean state hacking group within the wider Lazarus Group. The group is known for fake crypto trading apps and fake job offers, and the FBI has publicly tied it to the theft of roughly 1.5 billion dollars from the Bybit exchange in February 2025.
Why we took the name
Every betrayal begins with trust.
A trader trusts an app. An employee trusts a job offer. A user trusts a wallet, a website, a line of code, a machine. TraderTraitor, the group, built its fortune on exactly that, and we took the name because it says the thing this site exists to say: betrayal never starts with an attack, it starts with someone deciding to believe. Whether that trust is placed in a person or in a system, understanding how it is earned and how it is exploited is the best defence there is. Left on the open market, a domain like this is a gift to the next scammer. We did not have to wait long to be proved right.
The copycat
On 30 October 2026 at 07:51 UTC, about two and a half hours after we registered tradertraitor.com, someone else registered tradertraitor.org. Within a day it was serving a polished site calling itself "TRADERTRAITOR//GROUP, Bitcoin Mixing Service."
The pitch is simple. Choose an amount between 0.001 and 50 BTC. Pick a delay of 1 to 72 hours. Pay a fee of 1.4% to 2.6%, plus 0.35% for "priority." Enter the wallet you want your coins sent to, and the site generates a deposit address.
We did not send it anything, and we would not. Here is what we found on the public page:
- The "live mixing activity" feed is not customer activity. The site's own label reads "public mempool, unconfirmed." It is a stream of ordinary Bitcoin transactions that anyone can see, presented as though they were mixing jobs.
- There is no one behind it. No company name, no terms of service, no privacy policy, no contact details.
- It appeared almost instantly. A full mixing interface went live within a day of the domain being bought.
- The name is the bait. Borrowing the name of a sanctioned North Korean theft group signals exactly who the site hopes to attract: people with coins they want to hide.
That last point is the trap. Someone moving dirty money cannot complain to anyone when it disappears. That makes them ideal victims. Send coins to an anonymous mixer and you are trusting a stranger who has every reason to keep them.
Even if a service like this does pay out, it is offering anonymous laundering with no identity checks. US authorities have sanctioned and prosecuted mixing services and their operators. Using one can put the user in legal trouble, not just the operator.
We have reported tradertraitor.org to Cloudflare, which registers and hosts it, to Google Safe Browsing, and to Chainabuse.
The lesson: a familiar name, a slick dashboard and a "live" feed prove nothing. Before you trust a crypto service, ask who runs it, where they are, and what happens to your money if they vanish. If you cannot answer all three, walk away.