The FBI is encouraging the private sector to help contain the $1.5 billion in cryptocurrency stolen from the Bybit exchange last week by North Korean hackers.
The bureau posted an alert Wednesday attributing the incident to a threat actor known as TraderTraitor or Lazarus, following similar assessments by cybersecurity researchers.
The FBI provided a list of Ethereum wallet addresses associated with the attack and urged anyone handling virtual assets to be vigilant about potential interactions with them.
“TraderTraitor actors are proceeding rapidly and have converted some of the stolen assets to Bitcoin and other virtual assets dispersed across thousands of addresses on multiple blockchains,” the alert said. “It is expected these assets will be further laundered and eventually converted to fiat currency.”
Blockchain intelligence company TRM Labs said Thursday that about $400 million had been laundered already.
“Beyond the sheer scale of the Bybit hack, the speed at which the stolen funds are being laundered is particularly alarming,” the company said.
The wallet service Safe confirmed on Wednesday that the attack “was conducted by compromising a Safe Wallet developer machine which affected an account operated by Bybit” and said it “added security measures to eliminate the attack vector.”
Bybit is offering up to $140 million in bounties to anyone who can prove they have frozen funds from the attack. As of Thursday morning, 12 “hunters” had been awarded about $4.2 million so far. CEO Ben Zhou released a preliminary report on the incident from incident response company Syngia and financial security firm Verichains.
Operators of remote procedure call (RPC) nodes — servers that connect applications to blockchains — as well as crypto exchanges, decentralized finance (DeFi) services and other entities should “block transactions with or derived from addresses TraderTraitor actors are using to launder the stolen assets,” the FBI said.
Recorded Future
Intelligence Cloud.
No previous article
No new articles
Joe Warminsky
is the news editor for Recorded Future News. He has more than 25 years experience as an editor and writer in the Washington, D.C., area. He previously he helped lead CyberScoop for more than five years. Prior to that, he was a digital editor at WAMU 88.5, the NPR affiliate in Washington, and he spent more than a decade editing coverage of Congress for CQ Roll Call.
Weekly Recap: VPN Exploits, Oracle’s Silent Breach, ClickFix Surge and More