Cryptocurrency firms and law enforcement agencies are racing to recover more than $6bn worth of digital assets stolen from Binance, as alleged North Korean hackers deploy sophisticated money laundering techniques to move the funds beyond the reach of investigators.
The recovery efforts have become a race against time, with blockchain intelligence firms tracking the stolen assets as hackers attempt to obscure transaction trails, exploit cryptocurrency networks and use international money laundering organisations to convert digital assets into traditional currencies.
According to experts who spoke to CNBC, the attackers are deploying a combination of cryptocurrency obfuscation techniques and professional global money laundering networks to move the stolen funds.
Ari Redbord, Global Head of Policy at TRM Labs, one of the companies investigating the incident, said the ultimate objective of the hackers was to convert the stolen cryptocurrency into fiat currency, making recovery increasingly difficult.
ALSO: EV Makers Accuse FG Agencies of Double Standards Over Nigeria First Policy, Foreign Vehicle Purchases
“Ultimately, they’re trying to off-ramp it to fiat. And that becomes the challenge, that’s sort of this race against time,” Redbord told CNBC.
Binance has pledged to cover the losses through its Secure Asset Fund for Users (SAFU), a protection mechanism established to safeguard users against certain unexpected losses.
Both TRM Labs and Chainalysis have attributed the attack to TraderTraitor, a North Korean state-backed hacking group linked to previous cryptocurrency cyberattacks.
Following the incident, several stablecoin issuers, including Circle, which issues USDC, and Tether, the issuer of USDT, moved to freeze funds associated with the hack.
Stablecoins are cryptocurrencies designed to maintain a stable value, typically pegged one-to-one against traditional currencies such as the US dollar and backed by assets including cash and government securities.
Binance estimates that approximately $3bn worth of cryptocurrency has been frozen so far.
The frozen stablecoins could potentially be destroyed and reissued by their respective issuers, preventing hackers from accessing the original tokens while allowing recovered value to be transferred to an authorised government entity and eventually returned to Binance.
However, investigators said the attackers anticipated this possibility and moved quickly to avoid losing access to their assets.
According to TRM Labs, the hackers sold USDT to market makers and borrowed Ether against the stablecoins, shifting some of the exposure to a cryptocurrency that is more difficult to freeze.
Joe Hancock, a partner and head of cyber risk and complex investigations at law firm Mishcon de Reya, said the attackers appeared to have acted before the stablecoin freezing measures could fully restrict their activities.
“The attackers knew that route would be closed to them and so got out ahead of that,” Hancock said.
The remaining approximately $3bn in stolen assets has become more difficult to recover as investigators track the movement of funds across multiple blockchain networks.
Cryptocurrencies operate on blockchain networks, which maintain publicly accessible transaction records that allow investigators to follow the movement of assets between digital wallets.
However, hackers increasingly deploy techniques designed to complicate these investigations, including crypto mixers, automated transfers and repeated transactions across multiple wallet addresses.
Crypto mixers combine digital assets from different users to obscure the origins and destinations of funds, making it harder for investigators to establish ownership and trace stolen assets.
Jonathan Levin, Chief Executive Officer of Chainalysis, told CNBC that investigators had not observed clear evidence of traditional mixing services being used in the incident.
Instead, the company identified what it described as unusual laundering patterns involving automated transfers between different wallet addresses.
In a blog post, Chainalysis said the hackers repeatedly circulated funds among addresses, sometimes sending cryptocurrency back to wallets that had previously featured in the transaction sequence.
Rather than simply transferring stolen assets to new destinations, the repeated movements appeared designed to confuse blockchain investigators and make the transaction history more difficult to interpret.
Levin also disclosed that significant amounts of cryptocurrency had been moved through different addresses on the Tron blockchain, adding that his company had deployed automated systems and specialist teams to monitor the transactions.
“We’ve got teams working around the clock to continue to follow that. We’ve also got automated mechanisms now to track that. It’s not just manual work,” he said.
Investigators are also concerned that converting stablecoins into cryptocurrencies such as Bitcoin and Ether could make the assets more difficult to freeze, although blockchain transactions may remain traceable.
Redbord said blockchain intelligence firms were improving their ability to identify emerging laundering techniques and follow suspicious transactions.
He described the investigation as a continuing battle between hackers seeking to conceal stolen assets and forensic companies attempting to track and recover them.
“It’s this continued cat and mouse game where bad actors are trying to obfuscate their transactions and we are trying to track and trace them,” he said.
Beyond blockchain transactions, investigators are increasingly focusing on international money laundering networks believed to help cybercriminals convert stolen cryptocurrency into traditional currencies.
According to Chainalysis and TRM Labs, Chinese money laundering organisations have become an important part of the networks used by hackers to move illicit cryptocurrency into the conventional financial system.
Redbord said investigators were no longer focused solely on tracing North Korean actors on blockchain networks but were also pursuing professional money laundering organisations that facilitate the conversion of stolen digital assets.
The networks reportedly offer to purchase stolen cryptocurrency over the counter, often charging substantial fees before laundering the funds and returning the proceeds to the hackers, potentially through other digital assets or stablecoins.
Once the stolen cryptocurrency enters these networks and is converted into fiat currency, identifying and recovering the proceeds becomes considerably more difficult.
Levin warned that opportunities to seize stolen assets decline as the funds move further away from their original blockchain addresses and pass through multiple intermediaries.
“As you get further and further away, the amount of seizure opportunities go down,” he said.
The incident highlights the growing challenges facing cryptocurrency exchanges, blockchain intelligence companies and law enforcement agencies in combating sophisticated cybercrime and cross-border financial networks.
It also underscores the importance of real-time transaction monitoring, stronger cybersecurity measures and cooperation between cryptocurrency platforms, stablecoin issuers, financial institutions and international law enforcement agencies in responding to digital asset theft.
