North Korean hackers expected to take months to launder stolen Binance billions

{"text":[[{"start":8.92,"text":"North Korean hackers are expected to take months to launder the billions of dollars of tokens they stole last week from crypto exchange Binance, say analysts, despite using sophisticated automation to try and hide their tracks."}],[{"start":22.48,"text":"The FBI on Sunday blamed the heist on TraderTraitor, a hacker group linked to the secretive state, saying it expected the stolen assets to be widely laundered before being cashed out. Of the $6.3bn initially stolen, about $3.3bn remains under the group’s control after some tokens were frozen."}],[{"start":42.24,"text":"Although the thieves began laundering the stolen crypto immediately and are using automated tools to carry out thousands of transactions, crypto-tracing experts say the process will take months or longer."}],[{"start":53.84,"text":"The stolen tokens are visible to law enforcement on public blockchains, but the hackers are embarking on a long and complex process to shift them in small quantities through numerous venues as they try to make tracing the flow of funds as difficult as possible."}],[{"start":69.22,"text":"“This is going to be weeks, months and maybe even years . . . They will sit on them for a long period of time and try to identify opportunities to cash out,” said Phil Larratt, senior director of global services at Chainalysis, a blockchain-tracing company that is working with Binance."}],[{"start":null,"text":"

"}],[{"start":86.16,"text":"Jonathan Levin, co-founder of Chainalysis, said the hackers had “too much money for their trusted laundering venues to handle”, so the funds were being broken down into smaller chunks and sent “to a wider network of services”."}],[{"start":98.76,"text":"Key to the laundering effort are decentralised finance lending markets and crypto swapping services — used to swap one type of crypto for another without owners having to sell any tokens — which the hackers are using to convert the stolen tokens into other assets. They are using sophisticated automation methods to split up and send the funds to thousands of new wallets in an attempt to speed up the movement of money and make tracing harder."}],[{"start":null,"text":""}],[{"start":124.36,"text":"The Tron blockchain, created by crypto mogul and Donald Trump donor Justin Sun, is widely seen as an important tool for money launderers. The Anti-Money Laundering Network has called Tron “a notorious platform for sophisticated money laundering schemes”, favoured by criminals because of its “high-speed transactions and low fees”."}],[{"start":143.4,"text":"Analytics company Elliptic said each dollar’s worth of tokens that the hackers laundered through Tron had already moved nine times by the weekend, underlining the scale of the operation. At the height of the activity on Saturday, one transaction was sent every three seconds, it said."}],[{"start":159.8,"text":"Experts said conventional software automation was being used, rather than agentic AI. “It looks like scripts run by people,” said Tom Robinson, co-founder of Elliptic, and that there had been “pauses that looked like human working patterns”."}],[{"start":null,"text":""}],[{"start":174.4,"text":"Binance is still investigating how hackers managed to compromise its systems and is working with the FBI and blockchain analytics companies to try to trace the funds."}],[{"start":183.84,"text":"One way the hackers are seeking to hide the source of funds is by converting them into other tokens through decentralised finance platforms."}],[{"start":191,"text":"So-called DeFi platforms are unregulated and often involve automated contracts carrying out functions such as lending and borrowing, rather than traditional intermediaries such as banks and brokers. Diehard crypto enthusiasts relish the fact that DeFi protocols have little oversight and many do not require customers to submit to identity checks."}],[{"start":211.28,"text":"For example, minutes after the theft, the hackers had swapped $434mn worth of USDT for ethereum on decentralised exchanges and borrowed $45mn worth of ethereum against stolen USDT posted as collateral on the decentralised lending platform Aave, according to Elliptic."}],[{"start":null,"text":""}],[{"start":230.16,"text":"They used another decentralised exchange called SunSwap to convert $234mn of USDT into TRX, the native token of the Tron blockchain."}],[{"start":240.44,"text":"About $215mn worth of TRX tokens were split up and sent to about 7,700 newly created crypto wallet addresses, Elliptic said. On the way, some of the TRX was swapped for USDD, a stablecoin created by Sun in 2022 that bills itself as “freeze-free”, meaning that, unlike Circle and Tether’s stablecoins, no one can freeze it."}],[{"start":263.08,"text":"The hackers then used so-called cross-chain bridges including THORChain and Bitget Swap to convert those funds into ethereum. Cross-chain bridges move assets from one blockchain to another by taking the token on the first blockchain and paying it out in the form of new tokens on the destination blockchain. At least $147mn had been bridged out of Tron, Elliptic said. It currently sits in hundreds of new crypto wallets."}],[{"start":287.04,"text":"The hackers have also turned to so-called mixers. Transfers that are routed through mixers are difficult to trace because tokens from multiple sources are funnelled into one pot and the visible link between coins going in and coming out is broken."}],[{"start":301.72,"text":"To cash out, the hackers will eventually use crypto exchanges or brokers that carry out no customer checks."}],[{"start":308.44,"text":"Last year, the FBI blamed TraderTraitor for a $1.5bn theft from crypto exchange Bybit in what was at the time the biggest ever crypto hack."}],[{"start":318.48,"text":"“The funds will probably be cashed out in similar ways to Bybit and earlier North Korean hacks, through [over-the-counter] brokers, often Chinese-language traders,” said Robinson of Elliptic, adding that such services asked “little or no questions” of their customers."}],[{"start":334.72,"text":"The stolen Bybit funds were eventually converted into USDT and then cashed out, with the hackers paid in traditional currencies. “Much of that happens off-chain, which makes the final steps hard to see. It is also a point of weakness for them, because USDT can be frozen,” Robinson added."}],[{"start":352,"text":"North Korea on Tuesday denied involvement in the Binance hack, dismissing the FBI’s accusation as a “trite provocation”."}],[{"start":359.48,"text":"“The FBI is trying to brand the DPRK as a ‘cyber criminal state’,” the country’s official KCNA news agency quoted Kim Yo Jong, the influential sister of North Korean leader Kim Jong Un, as saying."}],[{"start":370.84,"text":"“It is a grave political provocation against the DPRK that the US misleads the international public opinion as if all the cyber crimes in different parts of the world are our deeds.”"}],[{"start":382.04,"text":"Binance has sought to reassure its users by promising to reimburse all tokens stolen by the hackers."}],[{"start":387.6,"text":"It has said it will pay this out of its own resources, including about $1bn worth of bitcoin held in its emergency fund and a portion of its own revenues denominated in tokens."}],[{"start":397.44,"text":"“It is a fact that we use Binance’s revenue to cover losses in order to ensure the safety of user assets,” Binance co-chief executive Yi He said on X on Monday."}],[{"start":407.8,"text":"Additional reporting by Song Jung-a in Seoul"}],[{"start":415.14,"text":""}]],"url":"https://audio.ftcn.net.cn/album/a_1793698492_3362.mp3"}