Jakub Porzycki | Null Photo | Getty Images
Cryptocurrency companies and law enforcement agencies are racing to recover more than $6 billion worth of cryptocurrencies stolen from Binance before hackers hide the funds.
Experts told CNBC that the two companies are playing a cat-and-mouse game with suspected North Korean hackers who are using a combination of cryptocurrency obfuscation technology and specialized global money laundering networks to turn their digital coins into fiat currency.
These developments highlight how difficult it is to recover stolen funds after a cryptocurrency hack.
“Ultimately, they (hackers) are trying to off-ramp (cryptocurrency) into fiat currency. And that becomes a challenge. It’s kind of a race against time,” Ari Redboard, global policy director at TRM Labs, one of the companies investigating the Binance hack, told CNBC on Friday.
Binance has promised to use its safe haven fund for users to cover losses.
Both TRM Labs and Chainalysis have attributed the Binance hack to a North Korean state-sponsored hacking group called TraderTraitor, which has a history of cryptocurrency cyberattacks.
frozen stablecoin
After the hack, several stablecoin issuers including: circleTether, which issues USDC and USDT, moved to freeze funds. Stablecoins are digital coins that represent currencies such as the dollar on a 1:1 basis and are backed by assets such as government bonds or fiat currencies.
Binance estimates that around $3 billion worth of cryptocurrencies have been frozen so far.
Stablecoin issuers may be able to burn and reissue tokens to recover losses. In this scenario, companies like Circle and Tether would effectively destroy frozen stablecoins, making them inaccessible to hackers. They can reissue new stablecoins, hold them in government institutions, and then return them to Binance.
Hackers were one step ahead. According to TRM Labs, they immediately sold the USDT to market makers and borrowed the cryptocurrency Ether against the stablecoin. Ether is difficult to freeze, leaving entities borrowed by hackers with stolen stablecoins.
“The attackers knew that route would be closed, so they got ahead of the curve and got out,” said Joe Hancock, partner and head of cyber risk and complex investigations at law firm Mishcon de Reya.
Obfuscate stolen funds
Hackers have used sophisticated tactics to evade law enforcement and prevent authorities from seizing the remaining roughly $3 billion.
Cryptocurrencies run on blockchain, which is a public ledger of transactions. This means that crypto forensics companies can track the movement of cryptocurrencies between different online wallets. Therefore, hackers use various techniques to keep investigators from tracking them.
Crypto mixer services blur the trail of cryptocurrencies by mixing funds from different users, making it difficult to trace funds.
Jonathan Levin, CEO of Chainalysis, told CNBC there is no sign yet that this will happen.
Instead, his company observed a “never-before-seen laundering pattern” in which hackers used automation to move funds between different wallets and sniff out investigators.
“Rather than simply moving funds forward, they often cycle funds repeatedly between addresses, sending funds back to addresses that were involved earlier in the sequence,” Chainalysis said in a blog post.
If a hacker exchanges a stablecoin for a cryptocurrency such as Bitcoin or Ethereum, the assets cannot be frozen.
Levin told CNBC that the hackers moved large sums of money to other Tron addresses. TRON is blockchain.
“Our team is working around the clock to keep this going,” Levin said. “Now we also have automated mechanisms in place to track it. It’s not just a manual process.”
All of these tactics make it difficult for companies to track stolen cryptocurrencies, but TRM Labs’ Redboard said his company is getting “increasingly good” at identifying these techniques.
“There’s a cat-and-mouse game going on where bad actors are trying to obfuscate transactions, and we’re trying to track and trace them,” Redboard said.
Global money laundering network
Chainalysis’s Levin and TRM Institute’s Redboard say hackers are increasingly using Chinese money laundering organizations to convert cryptocurrencies into fiat currency.
“So we’re not necessarily just tracking North Korea on-chain, but in many cases, we’re tracking these specialized money laundering networks,” he said.
On-chain refers to transactions on the blockchain, while off-chain refers to transactions that are not recorded on the blockchain. That may be because fiat currencies are involved.
Levin explained that money laundering organizations will offer to buy stolen cryptocurrencies over the counter for a hefty fee. They can then launder that money and return it to the hacker, possibly as some form of stablecoin, and exchange it for fiat currency.
Once this stage is reached, it becomes difficult to recover the stolen funds.
“As you move further away, the chance of a seizure decreases,” Levin says.
