Key Takeaways
- • Binance is working with crypto firms and law enforcement to recover more than $6 billion in cryptocurrency stolen in a hack, with roughly $3 billion frozen so far according to Binance's estimate.
- • Chainalysis and TRM Labs attribute the hack to TraderTraitor, a North Korean state-backed hacking group with a history of crypto cyberattacks.
- • Stablecoin issuers Circle (USDC) and Tether (USDT) moved to freeze funds, but hackers sold USDT to market makers and borrowed ether against it, placing ether beyond the reach of freezes.
- • Hackers are using automated, circular wallet transfers, Tron addresses, and Chinese money laundering networks to convert crypto to fiat, making recovery progressively harder.
- • Binance has pledged to cover losses through its Secure Asset Fund for Users (SAFU).
Summary
Crypto firms and law enforcement are racing to recover more than $6 billion in cryptocurrency stolen from Binance before the hackers can convert the funds to fiat currency, according to experts who spoke to CNBC. Investigators describe the effort as a "cat and mouse game" against alleged North Korean hackers. Binance has pledged to cover losses using its Secure Asset Fund for Users. Both TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean state-backed group with a history of cyberattacks.
Stablecoin issuers Circle, which issues USDC, and Tether, which issues USDT, moved to freeze the stolen funds. Binance estimates that around $3 billion in cryptocurrency has been frozen so far. Issuers could in principle burn and reissue frozen tokens, returning value to Binance through a legal government entity. According to TRM Labs, however, the hackers acted quickly, selling USDT to market makers and borrowing ether against the stablecoin. Ether is harder to freeze, and the lender would be left holding the stolen stablecoin. Joe Hancock, a partner at Mishcon de Reya, said the attackers "knew that route would be closed to them and so got out ahead of that."
The roughly $3 billion that remains unfrozen is being moved through increasingly sophisticated obfuscation. Because blockchains are public ledgers, forensic firms can trace transfers, so hackers use mixers and other techniques to disrupt that tracing. Chainalysis CEO Jonathan Levin said the firm has observed "laundering patterns we have not seen before," including automated transfers that repeatedly circulate funds among addresses, often sending them back to addresses used earlier in the sequence. Levin also said a large volume of funds has moved to Tron addresses, and that Chainalysis has teams and automated tools tracking that activity.
The final conversion stage presents the greatest difficulty. Levin said hackers increasingly use Chinese money laundering organizations, which offer to buy stolen crypto over the counter for a large fee and return value to the hackers, potentially in stablecoin form. Redbord of TRM Labs said investigators are "not necessarily only chasing North Korean on-chain" but also these professional networks. Levin noted that the number of seizure opportunities declines the further funds move from the original hack. Redbord said TRM is getting "better and better" at identifying these techniques.
Stablecoin issuers Circle, which issues USDC, and Tether, which issues USDT, moved to freeze the stolen funds. Binance estimates that around $3 billion in cryptocurrency has been frozen so far. Issuers could in principle burn and reissue frozen tokens, returning value to Binance through a legal government entity. According to TRM Labs, however, the hackers acted quickly, selling USDT to market makers and borrowing ether against the stablecoin. Ether is harder to freeze, and the lender would be left holding the stolen stablecoin. Joe Hancock, a partner at Mishcon de Reya, said the attackers "knew that route would be closed to them and so got out ahead of that."
The roughly $3 billion that remains unfrozen is being moved through increasingly sophisticated obfuscation. Because blockchains are public ledgers, forensic firms can trace transfers, so hackers use mixers and other techniques to disrupt that tracing. Chainalysis CEO Jonathan Levin said the firm has observed "laundering patterns we have not seen before," including automated transfers that repeatedly circulate funds among addresses, often sending them back to addresses used earlier in the sequence. Levin also said a large volume of funds has moved to Tron addresses, and that Chainalysis has teams and automated tools tracking that activity.
The final conversion stage presents the greatest difficulty. Levin said hackers increasingly use Chinese money laundering organizations, which offer to buy stolen crypto over the counter for a large fee and return value to the hackers, potentially in stablecoin form. Redbord of TRM Labs said investigators are "not necessarily only chasing North Korean on-chain" but also these professional networks. Levin noted that the number of seizure opportunities declines the further funds move from the original hack. Redbord said TRM is getting "better and better" at identifying these techniques.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.