AQSh Federal Tergov Byurosi (FBI) 6 milliard dollardan ortiq virtual aktivlarning o'g'irlanishini TraderTraitor — Shimoliy Koreya bilan bog'liq elita xakerlar guruhiga, shuningdek Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces va UNC4899 nomlari bilan kuzatiladigan guruhga rasman bog'ladi.
FBI, AQSh Maxfiy Xizmati (USSS) va Ichki Daromad Xizmati Jinoiy Tergov (IRS-CI) bilan birgalikda, tahdid aktori o'g'irlangan aktivlarni asosan Ethereum (ETH) ga aylantirayotganini kuzatganini aytdi.
"Bu aktivlar keyinchalik DeFi va tez almashtirish xizmatlari yordamida konvertatsiya qilinib, keyingi yuvish bosqichlari uchun tayyorlanishi kutilmoqda," — deb aytdi FBI bayonotida.
Agentlik, shuningdek, hujumchilar o'g'irlangan aktivlarni yuvish uchun foydalanayotgan deb aytilgan hamyon manzillarining ro'yxatini ham taqdim etdi.
Bu yangilik Binance hodisa natijasida to'xtatilgan birinchi bosqichdagi yechimlarni bugun UTC vaqti bilan 6 dan 9 gacha qayta boshlaganini aytgan paytda keldi.
"Hodisadan beri jamoalarimiz platformani himoya qilish uchun ehtiyot choralarini ko'rdi, xavfsizlik baholashlarini o'tkazdi va ta'sirlangan xizmatlarning tayyorligini tekshirish ustida ishladi," — deb aytdi Binance bayonotida.
"Biz xavfsizlik va tayyorlik tekshiruvlarini yakunlaganimiz sari yechimlarni bosqichma-bosqich tiklashni maqsad qilganmiz. Depozit xizmatlari ochiq va hodisadan ta'sirlanmagan."
Bu o'g'irlik 2025-yil fevralida Bybit'dan o'g'irlangan 1,46 milliard dollardan ancha katta bo'lib, tarixdagi eng yirik kriptovalyuta o'g'irligi hisoblanadi. Mablag'lar 11 ta blokcheyn bo'ylab o'g'irlangan, ularning 82 foizi Ethereum va Bitcoin'da bo'lgan.
"Bu yagona hodisa rejim tomonidan o'g'irlangan umumiy kriptoaktivlarni deyarli ikki baravar oshiradi," — deb aytdi blokcheyn tahlil firmasi Elliptic. "Shimoliy Koreya bilan bog'liq, rasmiy ravishda Koreya Xalq Demokratik Respublikasi (DPRK) deb ataladigan aktyorlar so'nggi yillarda 6,5 milliard dollardan ortiq kriptoaktivlarni o'g'irlagan deb ishoniladi."
TraderTraitor tomonidan o'g'irlangan 6,43 milliard dollardan 2,85 milliard dollarlik aktivlar Tether, Circle, Ripple, Arbitrum va Optimism tomonidan zanjirda muzlatilgan.
TraderTraitor — Web3.0 sanoatiga qarshi kriptovalyuta o'g'irliklarini amalga oshirish tarixi bor Shimoliy Koreya guruhiga berilgan nom bo'lib, u jabrlanuvchilarni zararli dasturlar bilan to'ldirilgan ilovalarni yuklab olishga aldash orqali harakat qiladi. Klaster kamida 2020-yildan beri faol.
So'nggi yillarda dushman DMM Bitcoin, Bybit, KelpDAO va Bitget'ni nishonga olgan kriptovalyuta o'g'irliklari bilan bog'langan.
SentinelOne, Zscaler ThreatLabz va Microsoft hisobotlari TraderTraitor o'z savdo texnikasini takomillashtirishda davom etayotganini, zararli dasturlarni tarqatish vektori sifatida trojanlashtirilgan Terraform provayderlaridan foydalanayotganini va kiberxavfsizlik, sun'iy intellekt, blokcheyn va kadrlar tanlash kompaniyalarida ishlaydigan shaxslarga ish mavzusidagi nishonlashni amalga oshirish uchun oldingi kompaniyalardan foydalanayotganini ochib berdi.
Zaharlangan Terraform provayderi Bash yuklovchisini yetkazish uchun ishlatiladi, u jabrlanuvchining operatsion tizimiga moslashtirilgan zararli dasturlarni tanlaydi va yuklab oladi. Bu FLATROOF deb nomlangan ko'p platformali implantni o'z ichiga oladi, u Python asosidagi ma'lumot o'g'irlovchisi yordamida jabrlanuvchidan sezgir ma'lumotlarni o'g'irlaydi va oxir-oqibat ROOFDECK orqa eshikni tushirib, to'liq masofaviy nazoratni qo'lga kiritadi.
Bu faoliyat Shimoliy Koreya tahdid aktyorlari ishonchli ishlab chiquvchi ish oqimlarini trojanlashtirilgan Terraform provayderlari orqali suiiste'mol qilishda, macOS, Linux va Windows tizimlarida ko'p platformali zararli dasturlarni tarqatishda va doimiy kirish huquqini olishda davom etayotganini yana bir bor namoyish etadi.
TraderTraitorning ish usuli, Lazarus Group'ning Operation Dream Job va Famous Chollima'ning Contagious Interview kabi boshqa Shimoliy Koreya bilan bog'liq kampaniyalar singari, jabrlanuvchilarni zararli kodni ishga tushirishga ishontirish uchun ishga yollash mavzusidagi aldovlardan foydalanadi. Ijtimoiy muhandislik bosqichi sun'iy intellekt (AI) yordamida ishonchli aldovlar yaratish, soxta shaxslar yaratish va aniqlashdan qochish uchun kuchaytiriladi.
"Aktyor maxsus domenlar, ijtimoiy tarmoq profillari va soha bilimlaridan foydalanib, sun'iy intellekt bilan quvvatlangan blokcheyn razvedka kompaniyasi sifatida o'zini ko'rsatdi va dasturiy ta'minot muhandisi mavzusidagi imkoniyatlardan foydalanib, murojaat bilan aloqaga kirgan shaxslar bilan bog'lanish va suhbatlarni rejalashtirish uchun foydalanildi," — deb aytdi Microsoft.
"Bu qisqa vaqt oralig'ida Jade Sleet ikki qo'shimcha oldingi kompaniya yordamida o'xshash ish mavzusidagi nishonlashni amalga oshirdi, bu esa o'xshash infratuzilma va tegishli domen bilimlari bilan qo'llab-quvvatlandi."
The U.S. Federal Bureau of Investigation (FBI) has officially attributed the theft of more than $6 billion in virtual assets to TraderTraitor, a North Korea-aligned elite hacking group also tracked as Jade Sleet, Pressure Chollima, PUKCHONG, Slow Pisces, and UNC4899.
The FBI, along with the U.S. Secret Service (USSS) and the Internal Revenue Service Criminal Investigation (IRS-CI), said it observed the threat actor converting stolen assets primarily into Ethereum (ETH).
"It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages," the FBI said in a statement.
The agency has also provided a list of wallet addresses that the attackers are said to be using to launder the stolen assets.
The development comes as Binance said it has resumed phase one of withdrawals starting today between 6 and 9 a.m. UTC after they were paused in the wake of the incident.
"Since the incident, our teams have taken precautionary measures to safeguard the platform, conducted security assessments, and worked to verify the readiness of affected services," Binance said in a statement.
"We aim to restore withdrawals progressively as we complete security and readiness checks. Deposit services remain open and are not affected by the incident."
The haul eclipses the $1.46 billion plundered from Bybit in February 2025, making it the largest cryptocurrency theft in history. The funds were stolen across 11 blockchains, 82% of which were on Ethereum and Bitcoin.
"This single incident almost doubles the total cryptoassets stolen by the regime," blockchain analysis firm Elliptic said. "Actors linked to North Korea, officially the Democratic People’s Republic of Korea (DPRK), are believed to have stolen over $6.5 billion in cryptoassets in recent years."
Of the $6.43 billion stolen by TraderTraitor, $2.85 billion of the assets have been frozen on-chain by Tether, Circle, Ripple, Arbitrum, and Optimism.
TraderTraitor is the name assigned to a North Korean group that has a history of orchestrating cryptocurrency thefts against the Web3.0 industry by tricking victims into downloading malware-laced applications. The cluster is known to be active since at least 2020.
In recent years, the adversary has been attributed to cryptocurrency heists targeting DMM Bitcoin, Bybit, KelpDAO, and Bitget.
Reports from SentinelOne, Zscaler ThreatLabz, and Microsoft have revealed that TraderTraitor is continuing to hone its tradecraft, using trojanized Terraform providers as a malware distribution vector and leveraging front companies to conduct job-themed targeting against individuals involved in cybersecurity, AI, blockchain, and talent recruitment companies.
The poisoned Terraform provider is used to deliver a Bash loader that selects and downloads malware tailored to the victim's operating system. This includes a cross-platform implant called FLATROOF, which siphons sensitive data from the victim using a Python-based information stealer before ultimately dropping the ROOFDECK backdoor to obtain complete remote control.
The activity once again demonstrates how North Korean threat actors continue to abuse trusted developer workflows through trojanized Terraform providers to deliver cross-platform malware across macOS, Linux, and Windows systems, and gain persistent access.
TraderTraitor's modus operandi, like other North Korea-linked campaigns such as Lazarus Group's Operation Dream Job and Famous Chollima's Contagious Interview, employs recruitment-themed lures as a pretext to convince victims to run malicious code. The social engineering phase is augmented by the use of artificial intelligence (AI) to craft convincing lures, create fake personas, and evade detection.
"The actor leveraged tailored domains, social media profiles, and industry-specific knowledge to pose as recruiters for a spoofed AI-powered blockchain intelligence company, using software engineer-themed opportunities to initiate contact and schedule interviews with individuals who engaged with the outreach," Microsoft said.
"Within this short time frame, Jade Sleet conducted similar job-themed targeting using two additional front companies, supported by comparable infrastructure and relevant domain knowledge."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
