Within North Korea’s sprawling hacking operations—often designed to earn money for the highly sanctioned and repressive regime—TraderTraitor has stood out in recent years for its sophistication and targeting of crypto and decentralized finance companies. Last year, the FBI named TraderTraitor as being responsible for the $1.5 billion hack against crypto exchange Bybit.
Binance did not answer WIRED’s questions about whether it believes North Korean hackers are behind the colossal heist, pointing towards a statement saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach,” the company says in a statement. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.”
“These folks in particular are somewhat artists in terms of getting into these distributed finance organizations,” Rafe Pilling, a senior director of threat intelligence at security company Sophos, tells WIRED. “TraderTraitor seems to focus on these larger operations. In the past, they’ve developed their own fake applications and tried to use those to get inside organizations.”
TRM and Chainalysis have initially linked the attack to TraderTraitor and say the determinations are based on their analysis of both on-chain and off-chain activity. “The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors,” a research blog from Chainalysis says.
“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says. “The attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, as in Bybit.”
While around $3 billion of cryptocurrency was initially frozen in the aftermath of the attack, it is likely those behind it could still potentially take away huge sums as not all of the stolen crypto can be frozen. Research from Chainalysis says the company is seeing money “laundering patterns we have not seen before” and that thousands of transactions being quickly processed indicates that they are using “automation to obscure the trail of funds.”
Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins. “The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says. “It can only be stopped when it reaches an exchange or other service. Some will be caught over the coming months, but I don’t expect the frozen share to rise much further.”