North Korea was behind the theft of more than $6bn from cryptocurrency exchange Binance last week, according to the FBI.
A brief statement from the Bureau published on October 31 attributed the breach to the TraderTraitor group (aka Jade Sleet, UNC4899, Slow Pisces).
“The FBI, together with partners at the US Secret Service and the Internal Revenue Service Criminal Investigation (IRS-CI), has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH),” it read.
“It is expected these assets will then be further laundered by converting them using decentralized finance products (DeFi) and instant swap services as they prepare them for further laundering stages.”
Read more on TraderTraitor: US and Japan Blame North Korea for $308m Crypto Heist.
The FBI and its partners urged crypto entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other virtual asset service providers to “block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets.”
According to Blockchain analytics company Elliptic, around $2.9bn of the stolen funds have been frozen or seized, but that still leaves almost $3.3bn outside the reach of issuers.
“At current prices, the attacker now controls around $3.25bn of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32bn), 18,327 BTC ($1.42bn) and 233 million XRP,” Elliptic explained.
“The ETH includes TRX laundered through bridges, which arrives on Ethereum and is split across hundreds of fresh wallets. Almost all of the stolen TRX has now been laundered. The XRP, SOL and NEAR, worth around $439m, have not moved at all since they were stolen.”
Binance Investigation Continues
Binance has said it will cover the costs of the incident, so customer funds are not in danger. However, it continues to investigate the actual cause of the breach.
Originally, the firm claimed that a compromised DevOps laptop may have been the source of the incident, but later added that it “uncovered additional points of breach” in what it is describing as a “complex attack.”
The attack was carried out by more than one individual, and used a “self-destruct mechanism that destroyed tooling and traces as it ran,” which has made forensic analysis harder, according to Elliptic.
TraderTraitor, which also has links to the Lazarus Group, APT 38 and AppleJeus, has been pegged for a string of historic crypto heists.
These include attacks on Japanese firm DMM, which cost the firm $308m, as well as Alphapo ($60m), CoinsPaid ($37m) and Atomic Wallet ($100m). TraderTraitor was also blamed for the previous record setter for biggest ever crypto breach, when it stole $1.5bn from Bybit.
Image credits: Anton Zubchevskyi / Andy.LIU / Shutterstock.com