加密货币公司和调查人员正争分夺秒地冻结和追踪数十亿美元被盗数字现金，这似乎是史上最大的加密货币盗窃案。周四下午4点左右（美国东部时间），黑客开始迅速从加密货币交易所币安的钱包中盗取约63亿美元的加密货币，这些资产分布在多条区块链上。
Cryptocurrency firms and investigators are racing to freeze and track down billions of dollars of stolen digital cash following what appears to be the largest crypto heist of all time. On Thursday, starting at around 4pm ET, hackers started quickly siphoning around $6.3 billion in cryptocurrencies, spread across multiple blockchains, from wallets belonging to crypto exchange Binance.
盗窃发生后，币安几乎立即暂停了其服务的所有存款和提现，作为对黑客攻击调查的一部分，并表示正在努力查明幕后黑手。该公司与其他加密货币公司表示，迄今为止已能够冻结约一半的被盗资金——实质上阻止了黑客进一步转移资金或试图套现。然而，剩余的大部分加密货币可能无法冻结。
Following the theft, Binance almost immediately suspended all deposits and withdrawals from its services as part of its investigation into the hack and says it is working to identify who was behind the breach. The company, along with other crypto firms, says it has so far been able to freeze around half of the stolen funds—essentially stopping hackers moving the money further or trying to cash it out. Much of the remaining crypto may not be possible to freeze, however.
三家加密货币追踪公司迅速将此次攻击可能与朝鲜黑客联系起来。椭圆公司首席科学家兼联合创始人汤姆·罗宾逊告诉《连线》杂志：“我们认为朝鲜很可能对此负责。如果朝鲜是幕后黑手，仅这一次盗窃就几乎会让该政权迄今为止窃取的加密货币总额翻倍。”根据加密货币追踪公司TRM Labs的分析，大部分被盗加密货币是在10月29日大约20分钟内被取走的。
Three crypto tracing firms have been quick to link the attack potentially to North Korean hackers. “We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED. “If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.”The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs.
根据TRM的分析，币安在至少十条区块链（包括以太坊、比特币、波场和索拉纳）上的钱包被清空，资金被发送到由单一攻击者控制的多个地址。TRM在一篇博客文章中表示：“准备工作至少在盗窃发生前36小时就已开始。”该公司称，攻击者的一个钱包在测试期间收到了三笔小额提款，随后扩大了操作规模。
Wallets belonging to Binance across at least ten blockchains—including Ethereum, Bitcoin, Tron and Solana—were drained and sent to multiple addresses controlled by a single attacker, according to TRM’s analysis. “Preparation began at least 36 hours before the theft,” TRM says in a blog post. The company says one of the attacker’s wallets received three small withdrawals during a test period, before later expanding the operations.
TRM表示：“10月29日早些时候，操作者部署了用于攻击的第一段代码，并在两个钱包上进行了测试。当天晚些时候，其在第三个钱包上预演了最终版本，随后将测试资金转回自身。预演四小时后，同一代码被安装到一个币安热钱包上。”热钱包是连接互联网的加密货币钱包，允许加密交易所处理客户提款。分析人士称，资金是从受影响各区块链上的热钱包中被转走的。
“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.”Hot wallets are cryptocurrency wallets that are internet connected and allow crypto exchanges to handle customer withdrawals. Analysts say the funds were drained from hot wallets across the impacted blockchains.
此次黑客攻击使用的手法似乎模仿了朝鲜精英黑客组织“TraderTraitor”此前使用的方法。加密货币追踪公司TRM Labs和Chainalysis均表示，他们认为TraderTraitor可能是此次攻击的幕后黑手，而罗宾逊表示，Elliptic并未将其具体与该组织联系起来，但认为相关活动存在重叠之处。
The tactics used in the hack appear to mimic previous methods used by an elite subset of North Korean hackers, known by the name TraderTraitor. Crypto tracing firms TRM Labs and Chainalysis both say they believe TraderTraitor may be behind the attack, while Robinson says Elliptic hasn’t specifically tied it to the group but sees overlaps in the activity.
币安和执法官员均未指出此次攻击与朝鲜黑客之间存在任何可疑关联。近年来，朝鲜黑客多次针对加密货币公司，通过加密盗窃窃取了数亿美元。多个朝鲜黑客组织能够针对该行业的公司，但TraderTraitor已成为专家，实施不频繁但高调的攻击。
Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers. Over recent years, North Korean hackers have repeatedly targeted cryptocurrency firms and stolen hundreds of millions in crypto heists. Multiple North Korean hacking groups can target companies in the sector, but TraderTraitor have become specialists, pulling off infrequent but high profile attacks.
在朝鲜庞大的黑客行动中——这些行动往往旨在为这个受到严厉制裁和压制的政权赚钱——TraderTraitor近年来因其老练程度以及针对加密货币和去中心化金融公司的目标而脱颖而出。去年，美国联邦调查局认定TraderTraitor对加密货币交易所Bybit遭到的15亿美元黑客攻击负责。
Within North Korea’s sprawling hacking operations—often designed to earn money for the highly sanctioned and repressive regime—TraderTraitor has stood out in recent years for its sophistication and targeting of crypto and decentralized finance companies. Last year, the FBI named TraderTraitor as being responsible for the $1.5 billion hack against crypto exchange Bybit.
币安没有回答《连线》关于其是否认为朝鲜黑客是这起巨额盗窃案幕后黑手的提问，而是指向一份声明，称公司将承担此次黑客攻击的所有损失，并正在与执法官员合作查明责任人。
Binance did not answer WIRED’s questions about whether it believes North Korean hackers are behind the colossal heist, pointing towards a statement saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.
该公司在一份声明中表示：“我们的初步调查表明，这起安全事件可能涉及一台被入侵的笔记本电脑，然而，我们随后的调查发现了更多入侵点。”“这是一次复杂的攻击，我们正在与执法部门协调，尽一切努力解决此事。”
“Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach,” the company says in a statement. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.”
安全公司Sophos威胁情报高级总监拉夫·皮林告诉《连线》杂志：“这些人尤其擅长渗透这类去中心化金融组织。”“TraderTraitor似乎专注于规模较大的行动。过去，他们曾开发自己的虚假应用程序，并试图利用这些程序进入组织内部。”TRM和Chainalysis最初将这起攻击与TraderTraitor联系起来，并表示这些判断是基于他们对链上和链下活动的分析。
“These folks in particular are somewhat artists in terms of getting into these distributed finance organizations,” Rafe Pilling, a senior director of threat intelligence at security company Sophos, tells WIRED. “TraderTraitor seems to focus on these larger operations. In the past, they’ve developed their own fake applications and tried to use those to get inside organizations.”TRM and Chainalysis have initially linked the attack to TraderTraitor and say the determinations are based on their analysis of both on-chain and off-chain activity.
Chainalysis的一篇研究博客写道：“最有力的证据出现在Chainalysis调查人员实时观察到从币安窃取的资金与上月Bitget漏洞利用中被盗的资金混在一起之时，后者已被归咎于朝鲜行为者。”
“The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors,” a research blog from Chainalysis says.
“币安表示，攻击始于一名工程师被入侵的笔记本电脑。针对加密货币公司员工是TraderTraitor的典型手法，”埃利普蒂克的罗宾逊说。“攻击者通过Tornado Cash为其钱包提供资金，并事先演练了此次攻击，与Bybit事件如出一辙。”
“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says. “The attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, as in Bybit.”
尽管攻击发生后最初约有30亿美元的加密货币被冻结，但幕后黑手仍有可能卷走巨额资金，因为并非所有被盗加密货币都能被冻结。Chainalysis的研究称，该公司正看到“我们此前从未见过的洗钱模式”，数千笔交易被快速处理，表明他们正在利用“自动化来掩盖资金踪迹”。
While around $3 billion of cryptocurrency was initially frozen in the aftermath of the attack, it is likely those behind it could still potentially take away huge sums as not all of the stolen crypto can be frozen. Research from Chainalysis says the company is seeing money “laundering patterns we have not seen before” and that thousands of transactions being quickly processed indicates that they are using “automation to obscure the trail of funds.”
埃利普蒂克的罗宾逊表示，迄今为止，加密货币公司和交易所已冻结约28亿美元，约占被盗总额的44%，其中几乎全部是稳定币。“剩余的33亿美元主要是比特币、以太币和XRP，这些无人能够冻结，”罗宾逊说。“只有当它们到达交易所或其他服务机构时才能被拦截。未来几个月内会截获一部分，但我预计被冻结的比例不会再有太大上升。”
Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins. “The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says. “It can only be stopped when it reaches an exchange or other service. Some will be caught over the coming months, but I don’t expect the frozen share to rise much further.”