coindesk.com
The U.S. FBI confirmed that North Korea’s TraderTraitor hacking group was behind last week’s theft of over $6 billion from Binance, asking the crypto community to block transactions from hundreds of addresses that at one point held funds from the hack.
According to the Saturday statement, the hackers had been converting the stolen funds mainly into ether ETH$2,265.25, and the FBI said it expects the hackers to use swap services and other decentralized finance (DeFi) tools to continue laundering the funds.
“FBI, USSS, and IRS-CI are urging private sector entities including THORNode operators, RPC node operators, instant exchanges, DeFi services, blockchain analytics firms, and other virtual asset service providers to block transactions with or derived from addresses TraderTraitor actors are using to launder these stolen assets,” the statement said.
Read all of CoinDesk’s coverage on the Binance hack.
The FBI listed over 600 Ethereum addresses, just under 20 Bitcoin addresses and a single Solana address in Saturday’s notice.
Binance was hacked on Thursday, losing some $6.4 billion in an attack that several analytics services and individuals attributed to North Korea’s TraderTraitor hacking group. TraderTraitor is a subunit of the infamous Lazarus Group, which had also conducted a number of high-profile crypto exchange breaches.
Stablecoin issuers froze over $2.4 billion of the stolen funds, but the attackers have continued laundering much of the remainder. Binance said earlier Saturday it had replenished 90% of the stolen cryptocurrencies and planned to resume customer withdrawals on Sunday.
Chainalysis: “Thousands of addresses” involved
While the FBI listed several hundred addresses on Saturday, the attackers have already used “thousands of addresses,” said Chainalysis CEO Jonathan Levin in a statement.
“We anticipate this will become tens of thousands over the coming weeks as money is transferred through a broader money laundering network,” he said. “They have too much money for their trusted laundering venues to handle. So the money will flow to a wider network of services, like bridges, instant exchanges, and swappers due to a wider set of money launderers.”
The attackers are using “novel automated laundering mechanisms,” he went on to say.
The blockchain analytics firm said in a blog post on Friday that the volume of transactions indicated that the attackers were using automated tools to try and “obscure the trail of funds” by circulating these funds between addresses before sending them onwards.
