Race to Claw Back Billions: Investigators Chase Alleged North Korean Hackers After Binance Theft

Crypto companies and law enforcement are racing to recover more than $6 billion in cryptocurrency stolen from Binance, before the attackers can hide it. Experts told CNBC that investigators are in a "cat and mouse game" with alleged North Korean hackers, who are using crypto obfuscation techniques and professional global money laundering networks to turn stolen digital coins into regular currency. TRM Labs and Chainalysis have attributed the hack to TraderTraitor, a North Korean state-backed group with a history of crypto attacks.

Some progress has been made. Stablecoin issuers including Circle (USDC) and Tether (USDT) moved to freeze funds, and Binance estimates about $3 billion worth of cryptocurrency has been frozen so far. In theory, issuers could destroy the frozen tokens and reissue new ones to be returned to Binance. However, the hackers moved first. According to TRM Labs, they quickly sold USDT to market makers and borrowed the cryptocurrency ether against the stablecoin. Ether is harder to freeze. As Joe Hancock of law firm Mishcon de Reya put it, the attackers knew that route would be closed and got out ahead of it.

Binance has pledged to cover user losses through its Secure Asset Fund for Users. Roughly $3 billion remains unfrozen, and the hackers are using sophisticated tactics to avoid seizure. The case shows how hard it can be to recover money once it has been stolen, even with fast action from many parties.