Driving the news: Binance said late Thursday that its blockchain partners have frozen at least $3 billion of those $6.3 billion in on-chain assets so far, and it believes hackers gained initial access by compromising an engineer’s laptop as well as other “breach points.”
- Several blockchain investigative firms have linked the hack to TraderTraitor, a group linked to the North Korean government’s Lazarus Group collective.
- Binance co-CEO Richard Teng said in a social media video on Friday that the attackers also used a “self-destruct mechanism that destroyed tools and traces” as they went, making it more difficult to investigate what happened.
- “This was a complex attack,” he said.
The big picture: North Korean government hackers have spent more than a decade carrying out financial heists and disruptive cyberattacks, and they have turned cryptocurrency theft into an industrial-scale operation.
- In 2016, hackers attempted to steal nearly $1 billion from Bangladesh’s central bank, managing to pocket $81 million.
- In 2017, North Korea was blamed for the WannaCry ransomware outbreak, which disrupted hundreds of thousands of computers in more than 150 countries.
- In recent years, the country has stepped up its efforts on looting crypto exchanges, in part because digital assets can more easily be transferred and laundered across borders – although these attacks tend to leave more of a paper trail.
- The same North Korean hacking group, TraderTraitor, also set the latest record for the world’s largest crypto heist last year by stealing $1.5 billion from crypto exchange ByBit.
Between the lines: North Korean hackers are only getting better and faster in their attacks, experts tell Axios.
- “They essentially crowd out other threat actors by stealing most of the value captured in a given year,” Eric Jardine, head of research at Chainalysis, told Axios.
Zoom: Chainalysis said in a research report on Friday that hackers took away billions of funds in just 20 minutes.
- The hackers also laundered and destroyed evidence of their operations at unprecedented speed, suggesting they used automation throughout the heist, researchers found.
- TRM Labs researchers discovered that hackers began planning the attack just 36 hours before it began.
- “There were transactions with a frequency and scale that simply meant that no one could be involved in approving them,” Jardine said. “It must have been done by a computer.”
The plot: Social engineering and automation are hallmarks of North Korea’s latest cyberattacks, Vijay Balasubramaniyan, CEO and co-founder of Pindrop Security, told Axios.
- Advances in AI-based video and audio tools have allowed the North Koreans to significantly expand their widespread IT worker fraud, where U.S. companies are tricked into hiring North Koreans for IT jobs.
- Balasubramaniyan said last year, North Korean applicants accounted for 1 in 343 applicants. This year, among their clientele, those applicants account for 1 in 47 applicants.
- “It’s absolutely the basis of everything,” Balasubramaniyan said. “It’s just not AI, it’s the scale of AI: you have so many choices in AI that the number of these tools is crazy, the cost is so cheap and it becomes an ecosystem.”
What to watch: Law enforcement and blockchain investigators might still be able to recover the other half of the stolen Binance funds if they enter specific exchange infrastructure and operators can act quickly enough to freeze them, Jardine said.
- “It’s still early,” he added.
Go further: How North Korea’s IT Army is Hacking the Global Job Market
Gn bussni
