TraderTraitor, a North Korean hacking operation focused on cryptocurrency and decentralized finance organizations, has gained a reputation for sophisticated attacks designed to generate revenue for the heavily sanctioned and repressive regime. The group was named by the F.B.I. last year as responsible for the $1.5 billion hack of cryptocurrency exchange Bybit, and researchers have now linked it to another major attack involving Binance.
Binance did not respond to WIRED’s question about whether it believed North Korean hackers were behind the heist. In a statement, the company said it would compensate users for losses caused by the hack and was working with law enforcement authorities to identify those responsible.
“While our initial investigation suggested that the security incident may have involved a compromised laptop, subsequent investigation revealed additional points of compromise,” Binance said. “This was a complex attack, and we are doing everything we can to work with law enforcement to resolve it.”
TraderTraitor’s focus on crypto organizations
“These people in particular are like artists when it comes to getting into decentralized finance organizations,” Leif Pilling, senior director of threat intelligence at security firm Sophos, told WIRED. “TraderTraitor appears to be focused on these large-scale operations. In the past, they have also developed their own fake applications and used them to try to infiltrate organizations.”
TRM and Chainalysis initially linked the attack to TraderTraitor, basing their assessment on analyses of both on-chain and off-chain activity. “The strongest evidence came to light when Chainalysis investigators observed in real time that funds stolen from Binance were mixed with funds stolen in last month’s incident,” the Chainalysis research blog said. The blog also said that the Bitget exploit was believed to have been carried out by a North Korean attacker.
“Binance says the attack started with a compromised engineer’s laptop. Targeting staff at crypto companies is typical of TraderTraitor,” said Elliptic’s Robinson. “Similar to Bybit, the attackers funded their wallets through Tornado Cash and rehearsed their attacks in advance.”
Billions in cryptocurrency remain difficult to recover
Approximately $3 billion in cryptocurrency was initially frozen after the attack. However, not all of the stolen assets can be frozen, meaning the attackers could still obtain large sums. Chainalysis said it was observing “a pattern of money laundering never seen before,” while the rapid processing of thousands of transactions indicated that the attackers were using “automation to hide the trail of funds.”
According to Robinson of Elliptic, crypto companies and exchanges have frozen about $2.8 billion, or approximately 44 percent of the total amount stolen so far. Almost all of those frozen assets are stablecoins.
“The remaining $3.3 billion is mostly Bitcoin, Ether and XRP, which no one can freeze,” Robinson said. “They can only be stopped if they reach exchanges and other services. Some will be caught in the coming months, but we don’t expect frozen shares to rise further.”
Source: www.wired.com
