Background on the Cryptocurrency Theft

On October 31, the FBI linked a massive theft of over $6 billion in cryptocurrency from Binance, the world’s largest digital asset exchange, to North Korea. This theft marks the largest known incident of cryptocurrency theft to date.

North Korea has publicly denied involvement in the incident, despite the FBI attributing the cyber intrusion to a specific activity known as “TraderTraitor,” categorized as malicious cyber activity from the country.

The Laundering Mechanism

According to a recent analysis by blockchain analytics firm Elliptic, North Korean operatives are using a series of homemade meme coins to launder the stolen cryptocurrency. These operations reportedly took place on the NEAR blockchain between November 5 and November 7, resulting in the creation of at least six unique meme coins.

During this period, approximately 117,000 NEAR, equivalent to around $430,000 at the time, was funneled through these coins, which serve little practical function beyond obscuring the laundering process.

Operation Details

Elliptic’s examination revealed that the laundering strategy involved establishing exchange pools designed to facilitate trading of the created meme coins. These pools allowed operatives to swap stolen NEAR tokens while disguising illicit transactions as legitimate trading activities.

• The tokens were traded just after their creation, with significant activity noted before November 8.
• This process helped shield the true nature of the wallet recipients, projecting them as legitimate investors enjoying trading profits.
• Creating each token involved a cost of approximately $90.

Tracing the Transactions

Despite the public nature of transactions on the blockchain, which allows investigators to trace activities, the laundering process introduces layers that complicate analysis. By replacing direct wallet-to-wallet transfers with a series of trades, the launderers create a difficult trail to follow, slowing down investigative efforts.

Current Status of the Stolen Funds

As of Elliptic’s update on November 9, the conversion of stolen assets into Bitcoin was roughly estimated at $225 million. Additionally, approximately $2.85 billion worth of funds are either frozen or seized, leaving around $3 billion still linked to theft-related addresses.

Conclusion

The techniques employed by North Korea to launder these funds highlight the increasing complexity of cybercrime in the cryptocurrency space and the challenges faced by law enforcement in tracking such operations.