FBI Shimoliy Koreya davlat homiyligidagi xakerlarni rekord darajadagi Binance kriptovalyuta o‘g‘irligida rasman aybladi va kripto sanoatidan o‘g‘irlangan mablag‘larning yuvilishiga yo‘l qo‘ymaslikda yordam so‘radi.
Hujum 29-oktabrda amalga oshirildi. Xakerlar bir nechta blokcheynlarda Binance issiq hamyonlarini bo‘shatib, mablag‘larning katta qismini taxminan 20 daqiqa ichida olib chiqib ketishdi. Binance ta’sirni taxminan 6,3 milliard dollar deb baholaydi, bu tarixdagi eng yirik kripto o‘g‘irlikdir.
Bir necha soat ichida blokcheyn razvedka firmalari TRM Labs va Chainalysis hujumni Shimoliy Koreya TraderTraitor guruhi bilan bog‘lashdi. Binance dastlab kirish DevOps muhandisining buzilgan noutbukidan boshlanishi mumkinligini aytdi va barcha yo‘qotishlarni qoplashga va’da berdi.
FBI 31-oktabrda, o‘g‘irlikdan ikki kun o‘tib, ayblovini e’lon qildi.
"FBI, AQSh Maxfiy Xizmati va IRS-CI hamkorlari bilan birgalikda, TraderTraitor ishtirokchilari o‘g‘irlangan aktivlarni asosan Ethereum (ETH) ga aylantirayotganini kuzatdi. Bu aktivlar keyinchalik DeFi va tez almashuv xizmatlari orqali yuvilib, keyingi yuvish bosqichlariga tayyorlanishi kutilmoqda", — deb aytdi agentlik.
Ogohlantirishda hozirda o‘g‘irlikdan tushgan mablag‘larni saqlagan yoki avval saqlagan 608 ta Ethereum manzili, 19 ta Bitcoin manzili va bitta Solana manzili nomi keltirilgan.
Maxfiy Xizmat va IRS-CI bilan birgalikda FBI THORChain tugun operatorlari, RPC tugun operatorlari, tez almashuvlar, DeFi xizmatlari va blokcheyn tahlil firmalarini ushbu manzillar bilan bog‘liq tranzaksiyalarni rad etishga chaqirdi.
FBI avval ham 2025-yil fevralida 1,5 milliard dollarlik Bybit xakerligida xuddi shu guruhni ayblagan edi.
Binance hujum bitta noutbukdan tashqariga chiqqanini aytadi
Binance o‘z dastlabki xulosalarini kengaytirdi. "Dastlabki tekshiruvimiz xavfsizlik hodisasi buzilgan noutbuk bilan bog‘liq bo‘lishi mumkinligini ko‘rsatdi, ammo keyingi tekshiruvimiz qo‘shimcha buzilish nuqtalarini aniqladi", — dedi Binance hamraisi Richard Teng bayonotida.
Teng hodisani murakkab hujum deb ta’rifladi, u "bir kishi tomonidan amalga oshirilmagan". U hujumchi o‘z vositalari va dalillarini o‘chirib tashlaydigan o‘z-o‘zini yo‘q qilish mexanizmini ham ishga tushirganini, bu esa tekshiruvni murakkablashtirganini aytdi.
U hujumchining Ethereum EIP-7702 delegatsiya xususiyatidan foydalanishi "bizning odatiy tasdiqlash nazoratlarimizdan o‘tmaganini" aytdi. Binance hali qo‘shimcha buzilish nuqtalarini batafsil bayon qilmagan va faktlar tasdiqlangach texnik post-mortem va’da qilgan.
Binance 1-noyabrda Bitcoin tarmog‘idan boshlab, pul yechishlarini bosqichma-bosqich qayta boshladi. Yakshanba kuni ertalab o‘rtalarida u taxminan 4,6 milliard dollar yechish va 1 milliard dollar depozitni qayta ishlaganini aytdi.
Birja ma’lumotiga ko‘ra, o‘g‘irlangan mablag‘ning taxminan 95 foizi hozirda kompaniya mablag‘lari yordamida almashtirilgan va Binance qolgan kam likvid tokenlarni bozorda va birjadan tashqari bitimlar orqali sotib olmoqda.
"Bizning majburiyatimiz aniq: Binance o‘g‘irlangan mablag‘larning moliyaviy ta’sirini o‘z zimmasiga oladi, foydalanuvchilarimiz emas", — dedi Teng.
Yuvish avtomatlashtirilganga o‘xshaydi
Blokcheyn tahlil firmasi Elliptic o‘g‘irlikni 11 blokcheyn bo‘yicha 6,43 milliard dollar deb baholaydi. Shundan u 2,85 milliard dollarni zanjirda muzlatilgan yoki musodara qilingan deb tasdiqlagan.
Ellipticning so‘nggi raqamlariga ko‘ra, hujumchi hech bir emitent muzlata olmaydigan taxminan 3,25 milliard dollarlik aktivlarni 800 dan ortiq manzilda nazorat qiladi. Bular taxminan 584 000 ETH, 18 327 BTC va 233 million XRP ni o‘z ichiga oladi.
"Bybit xakerligida yuvish inson ish tartibiga amal qilgan. Binance mablag‘lari esa uxlamaydigan narsa tomonidan harakatlantirilmoqda", — dedi Elliptic.
Tron’da mablag‘larni tarqatuvchi asosiy hamyon bir kundan ortiq vaqt davomida soatiga to‘lovlarni davom ettirdi, tun-u kun. Bir zanjirlararo ko‘prik depozitlarni rad etganida, tizim pulni yangi yaratilgan hamyonlar orqali xuddi shu manzilga yo‘naltirdi.
31-oktabr kechqurun bu hamyondan taxminan 196 million dollar 200 ga yaqin boshqa hamyonga o‘tdi. THORChain eng katta chiqish yo‘li bo‘lib, taxminan 31 million dollarni tashkil etdi.
Elliptic zanjirdagi ma’lumotlar avtomatlashtirish AI agentlariga yoki an’anaviy skriptlarga tayanishini ko‘rsata olmasligini aytdi. U yuvish Bybit xakerligidan keyin bo‘lgani kabi bir necha oy davom etishini kutmoqda.
Chainalysis ham avtomatlashtirishni ko‘rsatuvchi yuvish naqshlarini, jumladan qisqa vaqt ichida minglab tranzaksiyalar va birinchi o‘tkazmasi aynan 1 TRX bo‘lgan ko‘plab yangi manzillarni xabar qildi.
Bog‘liq: Polymarket savdogarlaridan 2 million dollardan ortiq mablag‘ yangi ta’minot zanjiri hujumida o‘g‘irlandi
Bog‘liq: Xakerlar Liquid Network’dan o‘g‘irlangan 263 million dollarni qaytarishdi
The FBI has formally blamed North Korean state-sponsored hackers for the record-breaking Binance cryptocurrency heist and is asking the crypto industry to help stop the stolen funds from being laundered.
The attack was conducted on October 29. Hackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes. Binance estimates the impact at roughly $6.3 billion, the largest crypto theft on record.
Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.
The FBI released its attribution on October 31, two days after the theft.
“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.
The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.
Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.
The FBI previously blamed the same group for the $1.5 billion Bybit hack in February 2025.
Binance says the attack went beyond one laptop
Binance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in a statement.
Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.
He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.
Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.
According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.
“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.
Laundering appears to be automated
Blockchain analytics firm Elliptic puts the theft at $6.43 billion across 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.
According to Elliptic’s latest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.
“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.
The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.
By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.
Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.
Chainalysis also reported laundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.
Related: $2 Million+ Drained From Polymarket Traders in New Supply Chain Attack
Related: Hackers Return $263 Million Stolen From Liquid Network