Within North Korea’s sprawling hacking operations, often designed to make money for the highly sanctioned and repressive regime, TraderTraitor has stood out in recent years for its sophistication and targeting of crypto and decentralized finance companies. Last year, the FBI named TraderTraitor as responsible for the $1.5 billion hack against crypto exchange Bybit.
Binance did not respond to WIRED’s questions about whether it believed North Korean hackers were behind the colossal heist, pointing to a statement that it would cover any losses resulting from the hack and work with law enforcement to identify who was responsible.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation uncovered additional points of violation,” the company said in a statement. “This is a complex attack, and we are doing everything we can in coordination with law enforcement to resolve it.”
“These particular people are sort of artists when it comes to getting into these distributed financial organizations,” Rafe Pilling, senior director of threat intelligence at security firm Sophos, told WIRED. “TraderTraitor appears to be focused on these larger operations. In the past, they have developed their own fake apps and tried to use them to break into organizations.”
TRM and Chainalysis initially linked the attack to TraderTraitor and say the determinations are based on their analysis of on-chain and off-chain activity. “The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance mixing with funds stolen in last month’s Bitget exploit, which had been traced to North Korean actors,” a Chainalysis research blog states.
“Binance claims the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a hallmark of TraderTraitor,” Elliptic’s Robinson said. “The attacker funded his wallet through Tornado Cash and rehearsed the attack in advance, like in Bybit.”
Although approximately $3 billion in cryptocurrencies were initially frozen following the attack, it is likely that those behind this attack could still potentially withdraw huge sums, as not all of the stolen cryptocurrencies can be frozen. Chainalysis’s research indicates that the company is seeing “patterns of money laundering that we’ve never seen before” and that thousands of rapidly processed transactions indicate that it is using “automation to hide the trail of funds.”
Elliptic’s Robinson says about $2.8 billion, or about 44% of the total amount stolen, has been frozen so far by crypto companies and exchanges, with almost all of it in stablecoins. “The remaining $3.3 billion is mainly made up of Bitcoin, Ether and XRP, which no one can freeze,” says Robinson. “It can only be stopped when it reaches an exchange or other service. Some will be captured in the coming months, but I don’t expect the frozen share to increase much more.”
Gn bussni
