Analysis: It may have been the largest single theft in history, but the hackers face many challenges in cashing in on their crime
Congratulations, you’ve just stolen $6.3 billion in cryptocurrency in approximately 20 minutes. You got clean away, nobody physically confronted you and you may just have pulled off the largest single theft in history. There’s just one problem: how are you going to spend it?
You cannot deposit your billions in a bank without attracting questions and much of your stolen fortune sits on public digital ledgers where investigators can watch it move. This is the predicament confronting those behind the 29 October attack on Binance, the world’s largest cryptocurrency exchange, a heist which the FBI has attributed to North Korea’s TraderTraitor hacking group.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
From RTÉ Radio 1’s Today with David McCullagh, cybersecurity consultant Brian Honan on the audacious heist at the world’s largest crypto exchange
Unlike cash, many cryptocurrencies leave a permanent, publicly accessible trail. Blockchains record transfers between digital wallets. Investigators may not know who controls a wallet, but they can see assets arriving and leaving it. Some cryptocurrencies can even be frozen before the criminals have a chance to move them further.
One example is Tether, a cryptocurrency designed to maintain the value of the US dollar. Unlike Bitcoin, it is issued by a company that has the power to block certain transactions involving its tokens. Within just 37 minutes of stolen Tether tokens reaching a principal attacker-controlled wallet, the company had frozen more than a billion dollars’ worth. By 1 November, approximately $2.85 billion in stolen cryptocurrency had been frozen or seized, representing around 44% of Elliptic’s estimate of the theft. Meanwhile, Binance has been replacing the stolen assets using its own financial reserves and emergency protection funds. By 1 November, the exchange said it had replenished approximately 95% of the losses and committed to covering the remainder.
However, there is an important distinction: replacing customers’ cryptocurrency is not the same as recovering it from the hackers. While Binance may be restoring its customers’ holdings, billions in stolen assets remain the subject of an ongoing investigation. The customers may be getting their money back, but that doesn’t necessarily mean the criminals have lost theirs.
From DW News, how hackers drained Binance of $6.3 billion in 20 minutes
The reason some assets could be stopped is because certain cryptocurrencies have issuing companies with powers to block transfers. Bitcoin and Ether, though, have no comparable central issuer capable of freezing their tokens. The criminals therefore faced an immediate dilemma: their fortune was enormous, but parts of it could be rendered unusable before they had time to move them. Investigators then watched an extraordinary scramble. Elliptic documented the attackers exchanging some stolen tokens for other cryptocurrencies, accepting losses of between 12% and 26% against market prices in certain transactions. Even billions in stolen assets can lose value quickly when speed matters more than getting a fair price.
The movement of the remaining assets suggests a highly automated operation. One attacker-controlled wallet made 1,113 transfers between 30 October and 1 November with a median gap of just 90 seconds, while some receiving wallets forwarded funds within 30 seconds. Such rapid movements can scatter stolen funds across a sprawling network of addresses, making the trail harder to reconstruct. However, each transfer adds another record that investigators can analyse. Specialist firms use software to link suspicious wallets and warn cryptocurrency businesses when stolen assets approach their services.
We need your consent to load this rte-player contentWe use rte-player to manage extra content that can set cookies on your device and collect data about your activity. Please review their details and accept them to load the content.Manage Preferences
From RTÉ Radio 1’s The Business, Conor Flynn from Waystone Digital Assurance on how the Binance hackers hit the jackpot
Moving cryptocurrency between wallets is only one part of the problem. Previous investigations reveal other ways criminals have tried to obscure the origins of digital assets. One approach involves moving stolen cryptocurrency between different blockchain networks using services known as bridges. Think of these as digital currency exchanges that allow assets held on one blockchain to be transferred or represented on another. For investigators, this means following the money across separate financial networks, each maintaining its own transaction records.
Another method involves cryptocurrency mixers, services that combine digital funds from multiple users before distributing them to new wallets. Imagine several people pouring their money into a shared pool before receiving equivalent amounts back. The aim is to make it difficult to establish which outgoing funds belong to which original sender. While neither approach makes stolen cryptocurrency automatically untraceable, both can complicate investigations by making the connections between transactions harder to establish.
From BBC News, North Korea is accused of using cyber criminals to help fund its military and nuclear program
But obscuring the trail is not the same as making stolen money spendable. Criminals seeking conventional currency, goods or services may encounter exchanges and other businesses that identify customers, monitor suspicious activity or cooperate with investigators. Other proceeds might be used within the cryptocurrency economy without ever passing through a traditional bank, so there is no single inevitable route. A publicly visible wallet is not a named individual and investigators still have to connect digital addresses to real-world actors, and possessing that evidence does not automatically enable seizure.
The Binance attack has exposed peculiar problems for anyone holding a stolen digital fortune: moving it can attract scrutiny, exchanging it can destroy value and leaving it untouched may give investigators more time to act. The FBI quickly identified the alleged perpetrators, and firms can monitor wallets associated with the theft.
But identifying suspects, tracking assets and actually recovering money are separate achievements. The central question is not whether the criminals can make every transaction disappear, but if they can obtain lasting value from what they stole, despite the financial trail they leave behind. Stealing the money took 20 minutes, but keeping it may take years.
Follow RTÉ Brainstorm on WhatsApp and Instagram for more stories and updates
The views expressed here are those of the author and do not represent or reflect the views of RTÉ
