Jakub Porzycki | Nurphoto | Getty Images
Crypto firms and law enforcement are racing to recover more than $6 billion worth of cryptocurrency stolen from Binance before hackers manage to hide the funds.
The firms say they’re in a «cat and mouse game» against alleged North Korean hackers who are using a combination of crypto obfuscation techniques and professional global money laundering networks to turn their digital coins into fiat currency, according to experts who spoke to CNBC.
These moves underscore how hard it can be to recover the stolen funds after a crypto hack.
«Ultimately, they’re [hackers] trying to off-ramp it [crypto] to fiat. And that becomes the challenge, that’s sort of this race against time,» Ari Redbord, global head of policy at TRM Labs, one of the companies investigating the Binance hack, told CNBC on Friday.
Binance pledged to cover losses using its Secure Asset Fund for Users.
Both TRM Labs and Chainalysis have attributed the Binance hack to a North Korean state-backed hacking group called TraderTraitor, which has a history of crypto cyberattacks.
Frozen stablecoins
After the hack, several stablecoin issuers, including Circle, which issues USDC, and Tether, which issues USDT, moved to freeze the funds. Stablecoins are digital coins that represent a currency, such as the dollar, 1-to-1 and are backed by assets such as government bonds or fiat.
Binance estimates that around $3 billion worth of cryptocurrency has been frozen so far.
The issuers of the stablecoins could burn and reissue the tokens and potentially recover those losses. In this scenario, a company like Circle or Tether would effectively destroy the frozen stablecoins, making them inaccessible to hackers. They could reissue new stablecoins that could be held in a legal government entity and then given back to Binance.
The hackers were one step ahead. They quickly moved to sell USDT to market makers and borrow the cryptocurrency ether against the stablecoin, according to TRM Labs. Ether is harder to freeze, and the entity the hackers borrowed from would be left with the stolen stablecoin.
«The attackers knew that route would be closed to them and so got out ahead of that,» said Joe Hancock, a partner and head of cyber risk and complex investigations at law firm Mishcon de Reya.
Obfuscating stolen funds
Hackers have used sophisticated tactics to evade law enforcement and keep authorities from seizing the roughly $3 billion that remains.
Cryptocurrencies run on blockchains, which are public ledgers of transactions. That means crypto forensic firms can track the movement of crypto across different online wallets. So hackers use various techniques to throw investigators off their trail.
Crypto mixer services obscure the trail of cryptocurrency by mixing funds from different users, making it harder to track the money.
Jonathan Levin, CEO of Chainalysis, told CNBC there are no signs of this happening yet.
Instead, his company observed «laundering patterns we have not seen before,» with hackers using automation to send funds back and forth between different wallets to throw investigators off their scent.
«Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence,» Chainalysis wrote in a blog post.
If hackers swap stablecoins into cryptocurrencies like bitcoin and ethereum, it’s not possible to freeze the assets.
Levin told CNBC that the hackers moved a lot of money to different Tron addresses. Tron is a blockchain.
«We’ve got teams working around the clock to continue to follow that,» Levin said. «We also have automated mechanisms now to track that. It’s not just manual work.»
All of these tactics will make it harder for companies to track the stolen crypto, but TRM Labs’ Redbord said his company is getting «better and better» at identifying these techniques.
«It’s this continued cat and mouse game where bad actors are trying to obfuscate their transactions and we are trying to track and trace them,» Redbord said.
Global money laundering networks
Hackers are increasingly using Chinese money laundering organizations to turn crypto into fiat, according to Chainalysis’ Levin and TRM Labs’ Redbord.
«So we are not necessarily only chasing North Korean on-chain, often we’re chasing these professional money laundering networks,» he said.
On-chain refers to transactions on blockchains, while off-chain refers to transactions not recorded there. That could be because it involves fiat currency.
Levin explained that money laundering organizations will offer to buy the stolen crypto over the counter for a large fee. They would then launder the money and get it back to the hackers, potentially in some form of stablecoin, which can then be exchanged for fiat currency.
When it gets to this stage, it becomes harder to recover stolen funds.
«As you get further and further away, the amount of seizure opportunities go down,» Levin said.
