FBI attributes $6bn Binance crypto heist to North Korea's TraderTraitor; laundering via ETH, DeFi and instant swaps
The FBI, with the US Secret Service and IRS-CI, attributed the theft of more than $6bn from cryptocurrency exchange Binance to North Korea's TraderTraitor group (aka Jade Sleet, UNC4899, Slow Pisces) in a statement published on October 31. The FBI says the actors are converting stolen assets primarily into Ethereum (ETH) and are expected to launder them further through DeFi products and instant swap services. Elliptic reports that around $2.9bn has been frozen or seized, leaving roughly $3.25bn the attacker controls across more than 800 addresses. Binance says it will cover the losses, so customer funds are safe, while its investigation into the root cause continues.
Detalhes técnicos
- Binance first suspected a compromised DevOps laptop, then said it "uncovered additional points of breach" in a "complex attack".
- Per Elliptic, more than one individual carried out the attack, and a self-destruct mechanism destroyed tooling and traces as it ran, hampering forensics.
- Elliptic says the unfreezable holdings include about 584,000 ETH ($1.32bn), 18,327 BTC ($1.42bn) and 233 million XRP.
- Stolen TRX has almost entirely been laundered through bridges onto Ethereum and split across hundreds of fresh wallets.
- XRP, SOL and NEAR, worth about $439m, have not moved since the theft.
- TraderTraitor has links to Lazarus Group, APT38 and AppleJeus. Past heists attributed to it include DMM ($308m), Alphapo ($60m), CoinsPaid ($37m), Atomic Wallet ($100m) and Bybit ($1.5bn).
Remediação
The FBI urges THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets.
Linha do tempo
-
FBI attributes $6bn Binance crypto heist to North Korea's TraderTraitor; laundering via ETH, DeFi and instant swaps
ler a análise desta fonte ocultar
The FBI, with the US Secret Service and IRS-CI, attributed the theft of more than $6bn from cryptocurrency exchange Binance to North Korea's TraderTraitor group (aka Jade Sleet, UNC4899, Slow Pisces) in a statement published on October 31. The FBI says the actors are converting stolen assets primarily into Ethereum (ETH) and are expected to launder them further through DeFi products and instant swap services. Elliptic reports that around $2.9bn has been frozen or seized, leaving roughly $3.25bn the attacker controls across more than 800 addresses. Binance says it will cover the losses, so customer funds are safe, while its investigation into the root cause continues.
Technical Details
- Binance first suspected a compromised DevOps laptop, then said it "uncovered additional points of breach" in a "complex attack".
- Per Elliptic, more than one individual carried out the attack, and a self-destruct mechanism destroyed tooling and traces as it ran, hampering forensics.
- Elliptic says the unfreezable holdings include about 584,000 ETH ($1.32bn), 18,327 BTC ($1.42bn) and 233 million XRP.
- Stolen TRX has almost entirely been laundered through bridges onto Ethereum and split across hundreds of fresh wallets.
- XRP, SOL and NEAR, worth about $439m, have not moved since the theft.
- TraderTraitor has links to Lazarus Group, APT38 and AppleJeus. Past heists attributed to it include DMM ($308m), Alphapo ($60m), CoinsPaid ($37m), Atomic Wallet ($100m) and Bybit ($1.5bn).
Remediation
The FBI urges THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms and other VASPs to block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets.