727 FinanceDaga satar dala biliyan 6.3 na Binance zuwa manyan sata a masana'antar cryptocurrency kamar Bybit da Ronin, ƙungiyar hackers ta Koriya ta Arewa TraderTraitor a hankali ta fito fili. Ta yaya wannan cibiyar hackers da gwamnatin Amurka ta ayyana ta yi amfani da ɗaukar ma'aikata na ƙarya, hare-haren sarkar samar da kayayyaki, da satar sa hannu don yin awon kusan dala biliyan 10 na kadarorin crypto?
Marubuci: BlockBeats
A ranar 1 ga Nuwamba, Hukumar Binciken Tarayyar Amurka (FBI) ta fitar da sanarwa da ke danganta dala biliyan 6.3 da aka sace daga Binance a ranar 29 ga Oktoba da Koriya ta Arewa. Sanarwar ta yi amfani da kalma ɗaya: TraderTraitor.
Idan ka bincika wannan sunan, za ka gano cewa dala biliyan 1.5 na Bybit, dala miliyan 300 na Bitget, da wasu manyan shari'o'in cryptocurrency da dama na shekarun baya duk suna da alaƙa da wannan sunan.
TraderTraitor ba kamfani ba ne, kuma ba kwali ba ne a kan ginshiƙin ƙungiya. Sunan lamba ne da gwamnatin Amurka ta ba wa wani nau'in ɗabi'a.
A watan Afrilu 2022, FBI, Hukumar Tsaro ta Yanar Gizo da Kayan More Rayuwa ta Amurka (CISA), da Ma'aikatar Baitulmalin Amurka tare suka fitar da sanarwa mai lamba AA22-108A. Wannan shi ne bayyanar farko ta hukuma ta wannan kalmar. A lokacin, tana nufin wasu trojans da aka ɓoye a matsayin manhajojin ciniki na crypto, kamar DAFOM, TokenAIS, da CryptAIS, waɗanda fuskokinsu suka yi kama da na gaske kuma waɗanda da zarar an shigar da su sai su fara satar maɓallan sirri.
Mutanen da ke bayan wannan an daɗe ana kiransu Lazarus Group, APT38, BlueNoroff, da Stardust Chollima a cikin masana'antar. Waɗannan ba ƙungiyoyi huɗu daban-daban ba ne. Lazarus babban suna ne; APT38 (Mandiant), BlueNoroff (Kaspersky), da Stardust Chollima (CrowdStrike) sunaye uku ne da kamfanoni daban-daban na tsaro suka ba wa layin neman kuɗi ɗaya.
Shekaru biyu bayan haka, an haɗa alamar da takamaiman ɗabi'a. A ranar 23 ga Disamba 2024, FBI, Cibiyar Laifukan Yanar Gizo ta Ma'aikatar Tsaro ta Amurka, da Hukumar 'Yan Sanda ta Ƙasar Japan tare suka fitar da dangantaka ga shari'ar satar dala miliyan 300 na DMM, inda suka yi amfani da jimlar "masu aikata laifukan yanar gizo na Koriya ta Arewa da ake bibiya da TraderTraitor" a karon farko kuma suka lissafa wasu sunaye uku: Jade Sleet (sunan Microsoft), UNC4899 (sunan Google), da Slow Pisces (sunan Palo Alto).
Bayanin yanzu ya ɗan bayyana: TraderTraitor ita ce sashin da ke cikin babbar ƙungiyar Lazarus wanda ya ƙware a kadarorin crypto kuma a halin yanzu shi ne mafi samun kuɗi. Aƙalla tun daga 2020, ya mai da hankali kawai ga blockchain—dandamalin ciniki, DeFi, masu ba da sabis na walat, asusun crypto, da mutanen da ke riƙe da adadi mai yawa na tsabar kuɗi.
Daga fashin bankuna zuwa fashin dandamalin ciniki
Lazarus babban suna ne da ke rufe komai, daga share rumbun kwamfuta na Sony Pictures a 2014 zuwa fitar da kuɗi daga Bankin Bangladesh a 2016.
Dauki shari'ar Bankin Bangladesh. Sashin da ya aiwatar da ita a lokacin ana kiransa APT38, wanda kuma ake kira BlueNoroff. A watan Fabrairu 2016, sun ƙirƙira umarnin SWIFT (tsarin saƙon ƙasa da ƙasa da ake amfani da shi don musayar kuɗi tsakanin bankuna) kuma sun yi ƙoƙarin fitar da dala biliyan 1 daga asusun Bankin Bangladesh a Fed na New York. A ƙarshe sun sami dala miliyan 81, saboda kuskuren rubutu a wata musayar ya sa wani banki mai shiga tsakani ya dakatar da ita.
Ƙwarewar nazarin hanyoyin gudanar da bankuna, gano guraben da babu kulawa a cikin bitar hannu, da ƙirƙira umarni daga baya an mayar da su ba tare da canji ba zuwa dandamalin ciniki na cryptocurrency.Kusan 2020. Sun fara inganta hanyoyinsu, inda duniyar crypto ce manufa. Dalili mai sauƙin tsammani: akwai kuɗi kuma babu ka'ida, kuma liquidity tana da kyau.
Akwai hanyoyi da yawa na kai hari.
Na farko shine ɗaukar ma'aikata na karya. Wani mai farautar ma'aikata yana tuntuɓar ka a LinkedIn, yana tattaunawa mai daɗi, sannan a ƙarshe ya aiko maka da "gwajin shirye-shirye kafin aiki" ko kuma mai sakawa na "kayan aiki na ciki." Da zarar an saka shi, na'urar ta zama tasu. An yi asarar dala miliyan 620 na Ronin ta wannan hanyar.
Na biyu shine sarkar samar da kayayyaki. Maimakon yaudarar mutane, sun koma gurɓata kayan aikin masu haɓakawa: ma'ajiyar da ba ta dace ba a GitHub, fakitin da aka guba a npm, masu samar da sabis na tantancewa kamar JumpCloud. An sami rauni ga mutum ɗaya, kuma jerin kamfanoni na ƙasa sun sami rauni suma.
Na uku shine canza ma'amaloli kai tsaye. A cikin shari'ar DMM ta Japan, sun sace bayanan shiga na ɗayan, sun shiga cikin sadarwar ciki na kamfanin walat ɗin Ginco, sannan suka canza canja wurin da ya kamata ya kasance na al'ada. A cikin shari'ar Bybit, sun yi kutse cikin kwamfutar wani mai haɓakawa a Safe{Wallet} kuma suka saka script a cikin gaban gidan yanar gizo; masu sa hannu har yanzu suna ganin shafi na al'ada, amma abin da suka sa hannu wata ma'amala ce daban.
Wannan kuma ya haɗa da shari'ar Binance a wannan lokacin.
Maharan sun shirya sa'o'i 36 kafin, sun sa hannu kan izini 50 na EIP-7702—sabon fasalin Ethereum wanda ke ba da damar walat ɗin ɗan lokaci ya "yi hayar" shirin don amfani—sannan suka sa walat ɗin zafi na Binance ya tura kuɗin da kansa; minti 40, a cikin cibiyoyin sadarwa 10. Ƙarshen wani kamfanin tsaro shine cewa da yiwuwar sun riga sun isa tsarin sa hannu na Binance.
Adadin da ya shafi shari'o'in wannan ƙungiyar
Shari'o'i goma sha biyu mafi shahara: dala biliyan 9.7.
Binance kaɗai ya kai dala biliyan 6.3. Sauran shari'o'i goma sha ɗaya, daga 2022 zuwa 2026, sun haɗu zuwa dala biliyan 3.44.
Dala biliyan 1.5 na Bybit shine gaban da aka canza; dala miliyan 620 na Ronin shine yaudarar ɗaukar ma'aikata; dala miliyan 388 na Bitget shine umarnin cire kuɗi na jabu da aka rubuta cikin tsarin walat.
DMM dala miliyan 308, WazirX dala miliyan 235, Harmony da Atomic dala miliyan 100 kowanne, Alphapo dala miliyan 60, CoinEx dala miliyan 55, Stake dala miliyan 41, CoinsPaid dala miliyan 37.
A cikin ginshiƙin, shari'o'in Binance, Bybit, da DMM ne kawai gwamnatin Amurka ta ambata kai tsaye a matsayin TraderTraitor. Ronin, Harmony, Stake, Alphapo, CoinsPaid, da Atomic FBI ta danganta su ga Lazarus/APT38; WazirX an ambata shi a cikin sanarwar haɗin gwiwa ta Amurka, Japan, da Koriya ta Kudu a Janairu 2025; CoinEx an kiyasta shi ne kawai ta kamfanonin nazarin on-chain. Shari'ar Bitget kamfanoni da yawa suna zargin tana da alaƙa da TraderTraitor, amma babu wanda ya danganta ta a hukumance.
A cewar ƙididdigar TRM, Koriya ta Arewa ta aiwatar da shari'o'i 100 tun 2017, jimillar kusan dala biliyan 12.8; dala biliyan 7.4 ya zuwa yanzu a wannan shekara; 85% na jimillar sacewar kadarorin crypto a duniya a 2026 ana danganta su ga Koriya ta Arewa. Wannan teburin ya ƙunshi goma sha biyu kawai daga cikinsu.Mutanen da fuskokinsu za a iya daidaitawa
Akwai fiye da ɗaya ɗan fashin kwamfuta na Koriya ta Arewa da jami'an Amurka suka ambata wanda kuma aka fitar da hotunansu. Park Jin Hyok, Jon Chang Hyok, da Kim Il duk suna cikin tuhumar da aka yi a watan Fabrairun 2021; a shekarar 2024, an ƙara Rim Jong Hyok, tare da ladan dala miliyan 10.
Park Jin Hyok (Park Jin Hyok), wanda FBI ke nema
Park Jin Hyok yana ɗaya daga cikin waɗanda aka fara tuhuma: a watan Yunin 2018, Ma'aikatar Shari'a ta Amurka ta shigar da ƙara a kansa, kuma an buɗe tuhumar a watan Satumbar wannan shekarar. Tuhumar ta ce makircin da ya shiga ya haɗa da harin Sony Pictures na 2014, harin WannaCry na 2017, da dala miliyan 81 da aka tura daga Bankin Bangladesh a 2016. Har yanzu yana kan gudu kuma bai taɓa bayyana a kotu ba.
Bin diddigin satar Binance
Binance ya rufe kusan kashi 90% da kuɗin kamfani, asusun SAFU, da asusun inshorar futures; sauran kashi 10% kuɗi ne marasa ruwa; duk asarar kamfanin ne ke ɗauka, ba masu amfani ba.
Ya zuwa ranar 1 ga Nuwamba, an daskare kusan dala biliyan 2.7, wato kusan kashi 42%, daga masu fitar da stablecoin da Majalisar Tsaro ta Arbitrum. Maharan har yanzu suna riƙe da ETH 420,000 da BTC 18,270, kusan dala biliyan 2.4.
Hanyar wanke kuɗi har yanzu ita ce ta yau da kullum: gadojin ƙetare sarkar don sauya sarkar, ayyuka kamar THORChain don musanya kuɗi, na'urorin haɗawa don haɗa da watsa kuɗin mutane da yawa tare, daga ƙarshe kuma cinikin da ba na kan layi ba.
An sami wasu cikas a wannan karon. Kwanan nan THORChain ya jinkirta wanke kuɗin da aka sata a harin Binance bisa kuskure saboda sake tsara sarkar Ethereum. Wannan sake tsara sarkar ya sa THORChain ya ba da maido da kuɗi sau biyu bisa kuskure ga wani mai amfani da ya ajiye ETH 10, wanda hakan ya haifar da dakatarwar gaggawa na yarjejeniyar, wanda na ɗan lokaci ya hana duk masu amfani yin musanyar ƙetare sarkar, ciki har da masu wanke kuɗi na ƙungiyar masu fashin kwamfuta ta Koriya ta Arewa.
A baya, kuɗin da aka sata daga Bitget ya bi ta THORChain, kuma THORChain bai daskare su kwata-kwata ba, yana cewa rarrabuwar kai na nufin ba za su iya daskare su ba—amma ba haka suka ce ba lokacin da aka yi wa kansu hari a baya. Idan THORChain ya dawo aiki, idan kuɗin da aka sata a satar Binance na wannan karon har yanzu ya bi ta THORChain, ba a san wane uzuri za su bayar don yaudarar mutane ba.