TRADERTRAITOR ISN'T SOPHISTICATED. IT'S EMPLOYED.

Ten separate articles this week. That is our Actor of the Week criterion, and it is worth being honest that it is a criterion about publishing rather than about attacking. Nothing about TraderTraitor has become novel. Nothing needed to. The reason this name keeps surfacing in the reporting is the thing the reporting is least comfortable saying out loud: the actor that worries people who have actually worked an intrusion is not the exotic one. It is the diligent one. The one that turns up. The one for which the way in has not changed in a decade, because it has not had to.

Hold the ten against the all-time tradecraft table, where Kimsuky has 89 techniques on file, APT28 has 73, APT38 has 71 and Lazarus Group has 70, and you will notice we have just put two different units of measurement on the same page. The table counts catalogue — breadth, longevity, how many analysts have had time to write a row. Our ten counts noise. Goodhart's law arrives on schedule: the moment technique count becomes the proxy for how dangerous a group is, you have built an index that rewards an actor for having been studied and penalises one for being boring and effective. Dangerous is not a number of techniques. Dangerous is a technique that still works.

In public attribution terms, TraderTraitor is DPRK. In practical terms it is the part of the problem set that goes where the money is now kept, which is to say the blockchain and cryptocurrency sector and the engineers who hold the keys to it. That is the whole shape of it. Not an exotic target, an obvious one. If you build an industry in which a single developer workstation can sit a short distance from irreversible transfers of value, you have not created a technology risk. You have created a very modern kind of bank, and then issued the vault to someone on a laptop at a kitchen table.

What it is publicly known for is, in general terms, the oldest shape in the book: the approach that arrives as an opportunity. Recruitment interest. A role. A project. A tool you would plausibly want. Then an artefact that has to be run on a real machine by a real person — a trading application, a package, a bit of code that a developer has every professional reason to execute without ceremony, because executing unfamiliar code is literally the job. It is not a heist. It is a paper round: the same route, every morning, nobody admires it, and it gets there.

Ontologically, this is the awkward part. A job offer and a payload are the same object viewed from two angles: a thing you were hoping to receive. Every control we have built assumes the malicious thing is unwanted. This one is wanted. It is flattering. It arrives addressed correctly, in the register of someone who has read what you do and thinks you are good at it. There is no technical property that distinguishes the message you were waiting for from the message you were waiting for.

Which is why the standard explanation — that people fall for this because they are careless — remains the most comfortable lie in the industry. People do not fall for recruitment lures because they are stupid. They fall for them because they are employed, under-promoted, on their fourth sprint, and somebody has finally noticed them. Dave from procurement will click the thing, as Dave always does, not out of malice but out of fatigue; the engineer will run the thing because running things is Tuesday. The phishing test measures whether they were busy that morning. They are always busy that morning.

A decade is the uncomfortable interval here. Not a decade of escalating sophistication — a decade of the same front door, repainted. Every year the reporting tells us tradecraft is evolving, and in some respects it genuinely is, and in the one respect that governs whether you get owned it is not evolving at all, because the initial access is a conversation and conversations do not need patching. The word the industry will reach for afterwards is sophisticated. The word it will not reach for, ever, is foreseeable. Those are not the same sentence, but only one of them goes in the press release.

Maureen from GRC has read the ten articles and asked the only question that matters, which is what evidence we hold that a developer machine in this organisation cannot reach anything it should not. Not a policy stating it. Not an attestation. Evidence. She notes, in the flat tone she reserves for architecture, that a control described in a document and never once observed in telemetry is not a control. It is a fossil with a version number. She has put it in the risk register under the heading we all accepted last quarter, which means we have agreed to be surprised about it on a schedule of the attacker's choosing.

Niko summarises the week as follows: "TraderTraitor remains a persistent threat to digital asset organisations, presenting both challenges and opportunities for forward-leaning security functions. Confidence: high. Recommended next step: a cross-functional workshop. I can take the minutes." Niko did not mention that HR is now an attack surface, that nobody owns it, and that the recruitment inbox is the least monitored externally-facing channel in most companies. Niko also did not mention the engineer who will be offered a role on Thursday. That engineer is the only thing that matters. — M.

If you want to do something with this week's ten articles other than forward them, the work is unglamorous, which is why it is still outstanding: treat developer endpoints as production, treat the build and dependency path as production, know which humans can reach signing material and value transfer, and get eyes on the channels where strangers are supposed to contact your staff. None of that is a product. All of it is what the public record of this actor has been politely suggesting for years. As the man says, everyone says it's impossible and it's not impossible, it's just work, and nobody wants to do the work.

I should be clear that I am not standing above any of this. I have, in my career, opened a document because the subject line used my first name correctly, and I have run code off the internet at eleven at night to make a thing go. I am the tired engineer and I am also the man writing the warning. We are not getting along. TraderTraitor does not need a new way in. You never closed the old one.