Crypto firms and law enforcement are locked in a tense effort to recover over $6 billion in cryptocurrency stolen from Binance. This massive theft, believed to be orchestrated by a North Korean state-backed group called TraderTraitor, has sparked a challenging operation to prevent the conversion of the stolen digital assets into fiat currency.
The hackers have been using a variety of methods to hide their activities, complicating the recovery efforts. Ari Redbord, who heads global policy at TRM Labs, highlighted the primary challenge: stopping the hackers from converting the stolen cryptocurrency into fiat. TRM Labs, alongside Chainalysis, is deeply involved in investigating this breach.
In reaction to the hack, Binance has pledged to cover the losses through its Secure Asset Fund for Users. At the same time, several stablecoin issuers, including Circle and Tether, have frozen the stolen assets. Binance reports that about $3 billion in cryptocurrency is currently frozen. This move allows the stablecoin issuers to potentially burn and reissue the tokens, aiming to recover the losses.
The hackers, however, anticipated such a response and quickly sold USDT to market makers, using it to borrow ether. This left the lender holding the stolen stablecoin. Joe Hancock, a partner at Mishcon de Reya, observed that the attackers were quick to sidestep expected countermeasures.
While the blockchain's public ledger allows forensic firms to trace funds across wallets, the hackers have been employing advanced tactics to stay hidden. Crypto mixer services, which blend funds from multiple users, are one method they've used to cover their tracks. Jonathan Levin, CEO of Chainalysis, pointed out that although traditional mixing hasn't been detected, new laundering techniques are being used. Hackers are automating fund movements across wallets, repeatedly sending money back to previously used addresses.
Levin also noted that the hackers have shifted significant amounts to various Tron addresses, a blockchain network. Chainalysis teams are working around the clock, employing automated systems to monitor these transactions. Despite the hurdles, Redbord expressed growing confidence in their ability to identify and counter these obfuscation strategies.
As the situation continues, hackers are increasingly relying on Chinese money laundering organizations to convert crypto into fiat. These groups purchase the stolen crypto over the counter for a fee, launder it, and return it to the hackers, possibly as stablecoins. This conversion complicates recovery as it narrows the window for seizing the assets.
Levin explained that as the stolen funds move further from their source, the chances of recovery decrease. The ongoing efforts by TRM Labs and Chainalysis illustrate a continuous cat-and-mouse game between hackers and investigators, with both sides constantly adjusting their tactics.
