朝鮮黑客洗劫$ 1.4億美元的bybit戰利品，以比特幣為目標，因為橢圓機跟踪交易

在轉換為比特幣之前，盜用資產通過不可追踪的交流進行有條不紊的轉移，這種方法使恢復工作變得複雜，正如橢圓機在周六的博客文章中指出的那樣。

North Korean hackers have begun laundering the funds stolen from Bybit, with blockchain analytics firm Elliptic tracking over $140 million in initial transactions aimed at obscuring the flow of money.

朝鮮黑客已經開始洗錢，從拜比特（Bybit）偷來的資金，區塊鏈分析公司橢圓形跟踪超過1.4億美元的初始交易，旨在掩蓋貨幣流量。

The misappropriated assets are being systematically transferred through untraceable exchanges before being converted into Bitcoin, a method that complicates the recovery efforts, Elliptic noted in a blog post on Saturday.

Elliptic在周六的博客文章中指出，盜用資產在轉換為比特幣之前，通過不可追踪的交流進行系統地轉移，這種方法使恢復工作變得複雜。

“The next stage of the laundering process will involve ‘layering’ the stolen assets to obscure the transaction trail,” Elliptic explained. “While this trail can be followed, the layering techniques will complicate the process, giving the launderers valuable time to fully liquidate the assets.”

橢圓機解釋說：“洗滌過程的下一個階段將涉及“分層”被盜資產以掩蓋交易小徑。” “儘管可以遵循這條路，但分層技術會使過程變得複雜，從而為洗衣者提供了寶貴的時間來充分清算資產。”

The $1.46 billion social engineering attack, which occurred on Friday and primarily involved Ethereum, marks the largest theft in the history of cryptocurrency, surpassing the $611 million heist from Poly Network in 2021.

這次14.6億美元的社會工程攻擊發生在周五，主要涉及以太坊，標誌著加密貨幣歷史上最大的盜竊，超過了2021年Poly Network的61.1億美元搶劫。

Elliptic and Arkham Intelligence have attributed the attack to North Korea’s Lazarus Group, noting the use of decentralized exchanges and services such as cross-chain bridges and coin swap services to misdirect investigators.

Elliptic和Arkham Intelligence將這次襲擊歸因於朝鮮的Lazarus集團，並指出了使用分散的交流和服務（例如跨鏈橋樑和硬幣交換服務）的使用來指導調查人員。

“If typical laundering patterns are followed, we may also see the use of mixers to further obfuscate the transaction trail,” the report noted, adding that this may present challenges due to the “unusually large volume of stolen assets.”

該報告指出：“如果遵循典型的洗滌模式，我們還可能看到使用混合器進一步混淆交易軌跡。”

Within hours after the theft, the attackers moved the stolen assets into 50 separate wallets, each containing around 10,000 ETH. According to Elliptic, these funds are now being emptied and converted into Bitcoin.

盜竊後的幾個小時內，攻擊者將被盜的資產移至50個單獨的錢包中，每個錢包包含約10,000 ETH。根據Elliptic的說法，這些資金現在被清空並轉換為比特幣。

The attackers initially converted stolen tokens such as stETH and cmETH into Ethereum via decentralized exchanges, presumably to evade possible freezes on the assets.

攻擊者最初通過分散的交流將被盜的代幣（例如Steth和Cmeth）轉化為以太坊，大概是為了避免資產上的凍結。

This aligns with the laundering playbook typically employed by the Lazarus Group, which involves converting stolen tokens into “native” blockchain assets prior to further obfuscation, Elliptic noted.

Elliptic指出，這與Lazarus集團通常使用的洗錢劇本一致，該手冊涉及將被盜的令牌轉換為“本地”區塊鏈資產，然後再進行混淆。

Since 2017, the group has reportedly stolen over $3 billion in cryptocurrency assets, which were used to fund North Korea’s ballistic missile program, a UN report from last year noted, although the actual figure is likely much higher, according to Elliptic.

據報導，自2017年以來，該集團已偷走了超過30億美元的加密貨幣資產，這些資產用於資助朝鮮的彈道導彈計劃，但據橢圓形的一份報告稱，儘管實際數字可能更高。

As a result of the theft on Sunday, Bybit is facing pressure from user withdrawals, with approximately 23,000 BTC being withdrawn from Bybit’s hot wallet, according to data from Arkham Intelligence.

根據Arkham Intelligence的數據，由於週日的盜竊案，Bybit面臨用戶提取的壓力，大約23,000 BTC從Bybit的熱錢包中撤回。

The exchange’s primary wallets have seen their Bitcoin balance decrease from 70,000 BTC to just over 52,000 BTC, indicating an outflow of around $1.7 billion since Friday afternoon, the data shows.

數據顯示，該交易所的主要錢包已經看到他們的比特幣餘額從70,000 BTC減少到剛好超過52,000 BTC，這表明自周五下午以來的流出約為17億美元。

Further analysis suggests that Bybit has experienced outflows totaling $6 billion across various cryptocurrencies.

進一步的分析表明，BYBIT在各種加密貨幣中經歷了總計60億美元的流出。

Anonymous Crypto Exchange AccusedElliptic and other analysts, including ZachXBT, have pointed to the anonymous cryptocurrency exchange eXch as facilitating “tens of millions of dollars” in stolen assets from the hack, despite Bybit’s requests for the exchange to halt the activity.

匿名加密交易所被指控和其他分析師（包括Zachxbt）指出，儘管Bybit要求對該活動停止該活動的要求，但匿名的加密貨幣交易所促進了“被盜資產”中的“數千萬美元”的資產。

“The stolen Ethereum is being continuously converted into Bitcoin, using eXch and other services,” Elliptic stated on Sunday.

橢圓機在周日說：“被盜的以太坊正在使用交易所和其他服務不斷轉化為比特幣。”

An alleged email response from eXch, which was archived on X over the weekend and cited by Elliptic, claims that the exchange chose not to respond to Bybit’s requests, arguing that Bybit has previously made “direct attacks on the reputation” of eXch.

據稱來自Exch的電子郵件回复，該回复在周末在X上存檔，並由Elliptic引用，聲稱該交易所選擇不響應Bybit的要求，認為Bybit以前曾對Exch的聲譽進行了“直接攻擊”。

“We find it difficult to understand the expectation of collaboration” from an organization that has “actively undermined our reputation,” the email from eXch stated.

Exch的電子郵件說：“我們發現很難理解一個“積極破壞我們聲譽”的組織的協作期望。

The exchange did not immediately respond to Decrypt’s request for comment.

交易所沒有立即回應解密的置評請求。

On Sunday, eXch claimed in a post on a Bitcoin forum that the accusations of facilitating money laundering were unfounded.

週日，交換在比特幣論壇上的一篇文章中聲稱，指控促進洗錢的指控是沒有根據的。

“We are not laundering money for Lazarus/DPRK,” eXch asserted, stating that such allegations represent the “view of some individuals who wish to eliminate the fungibility and on-chain privacy of decentralized coins.”

英格斷言：“我們不是為拉撒路/朝鮮洗錢。”此類指控代表了“一些希望消除分散硬幣的可及格性和鏈接隱私的人的觀點”。

“A small portion of the funds we processed from the Bybit hack in an isolated incident will be donated to various open-source initiatives that focus on privacy and security in and out of crypto space,” the exchange added.

交易所補充說：“我們從隔離事件中從拜比特黑客處理的一小部分資金將捐贈給各種開源計劃，這些倡議著重於加密貨幣空間內外的隱私和安全性。”

Edited by Sebastian Sinclair

由塞巴斯蒂安·辛克萊（Sebastian Sinclair）編輯