Deceiving Employees to Steal Virtual Assets…What is the True Nature of North Korea's 'TraderTraitor'?

Deceiving Employees to Steal Virtual Assets…What is the True Nature of North Korea's 'TraderTraitor'?

Binance $6 Billion Stolen…North Korean Hacking Activity Identified as the Mastermind

Exploiting Internal Access Privileges…Suspected Link to Lazarus

As 'TraderTraitor', a North Korea-linked hacking activity, has been identified as the mastermind behind the theft of over $6 billion in virtual assets from Binance, the world's largest virtual asset exchange, attention is focused on their identity and attack methods.

TraderTraitor is known for attack activities that deceive developers or employees of virtual asset companies into installing malicious code, using this as a foothold to infiltrate internal systems. A representative characteristic is social engineering attacks that exploit the access privileges of internal personnel, rather than directly targeting technical vulnerabilities.

◇ Lazarus-linked Hacking Activity…Deceiving Employees to Infiltrate Internally

According to the cybersecurity industry on the 2nd, the U.S. Federal Bureau of Investigation (FBI) identified North Korea's TraderTraitor as the mastermind behind the theft of over $6 billion in virtual assets from Binance on October 31 (local time).

TraderTraitor is a name used by the U.S. government to identify North Korean cyberattacks targeting the virtual asset industry, and it is classified as an activity linked to the North Korean hacking group Lazarus.

Rather than being a separate independent hacking group, it is closer to a name referring to specific attack activities and methods.

The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA), among others, warned in a joint security advisory in 2022 that TraderTraitor was targeting virtual asset exchanges, blockchain companies, and decentralized finance (DeFi) platforms.

Their core attack method is social engineering that exploits the trust of internal corporate personnel.

Attackers have used methods such as impersonating recruiters or industry professionals to approach developers, or distributing malicious applications disguised as legitimate virtual asset trading programs.

If a victim falls for the deception and executes a malicious program, the attacker gains access to that device. Subsequently, this is used as a foothold to infiltrate internal corporate systems or steal account information and access privileges.

The reason for the name TraderTraitor is that the attack method involves luring a trader and turning them into a traitor.

This method demonstrates that even if a virtual asset exchange has security systems in place to prevent external attacks, its asset management system can be exposed to risk if an internal employee's device or account is compromised.

◇ Binance Funds Moved in 20 Minutes…Possibility of Internal System Compromise

In this Binance incident, the possibility that the exchange's internal systems were exploited in the attack is being raised.

Blockchain analytics firm TRM Labs reportedly analyzed that approximately $6.36 billion worth of virtual assets were stolen in this attack, and most of them were moved within about 20 minutes.

In particular, attention was drawn to the possibility that the internal system generating valid transaction signatures from the exchange's wallet was compromised, and evidence was also presented that the attackers prepared for the attack for at least 36 hours and conducted preliminary tests through small transactions before the actual theft.

Other blockchain analytics firms also successively raised similar connections.

Blockchain analytics firm Chainalysis detected evidence in September that funds stolen from the virtual asset exchange Bitget, which was attributed to North Korean hackers, flowed into the same wallet as the funds from this Binance hack and were commingled.

Another analytics firm, Elliptic, also confirmed that stolen funds from Binance and Bitget were merged in multiple wallets and found connections to past virtual asset trading platform hacking incidents classified as TraderTraitor's work.

However, the initial infiltration route and specific attack process have not yet been confirmed.

TraderTraitor was also identified as the mastermind behind the Bybit virtual asset exchange hacking incident that occurred in February last year.

At that time, approximately $1.5 billion worth of virtual assets were stolen, and the FBI classified it as an attack carried out by North Korea's TraderTraitor activity. It was analyzed that the software environment used for transaction approval was compromised, and normal approval procedures were exploited, leading to a large amount of virtual assets being transferred to the attackers.

The money laundering techniques used to avoid tracking stolen virtual assets are also sophisticated. Attackers use mixer services, which make transaction history tracking difficult, and bridges, which support asset movement between blockchains, to distribute funds across multiple wallets.

The U.S. government suspects that North Korea's virtual asset thefts are likely linked to funding its weapons development programs, including nuclear and missile programs.