The shadowy crypto services helping the Binance hackers launder stolen billions

Summary

Some crypto developers say they can't stop North Korean hackers from laundering stolen funds through their platforms, frustrating law enforcement.

When hackers pulled off the biggest cyberheist in history last week -- pilfering more than $6 billion from cryptocurrency exchange Binance -- their work had only just begun.

Within minutes, the hackers began to execute an equally historic money-laundering operation, splintering funds into more than 10,000 crypto wallets, according to blockchain analytics firm Chainalysis -- part of an effort to ferry the ill-gotten gains beyond the reach of law enforcement and any crypto companies that might try to seize the money or block its passage.

Helping them do it are cryptocurrency services -- operated in part by Americans -- which have continued to process transactions linked to the heist and collect revenue from them, even after the Federal Bureau of Investigation urged them to stop, the blockchain analysis shows.

The laundering highlights a divide in the crypto industry over who bears responsibility when criminals use its technology, especially when it comes to decentralized services whose creators say aren't controlled by any one person.

One of those services, THORChain, processed more than $46 million in funds stolen from Binance within 72 hours of the heist, according to Chainalysis. The platform, which allows users to swap cryptocurrencies across different blockchains, has collected more than $200,000 in fees on the hackers' transactions -- income that goes to the people who help run its infrastructure.

In the same period, data from Chainalysis showed nearly $4 million was "mixed" through Wasabi Wallet -- which has a feature allowing users to transfer bitcoin while masking its source.

The developers of platforms like THORChain and Wasabi Wallet argue they can't -- or shouldn't have to -- intervene when the protocols are used by bad actors. That includes North Korea -- which the FBI has said was responsible for the Binance hack -- and many others. (North Korea has denied it hacked Binance.)

"The biggest avenue for [North Korea's laundering] is THORChain," said Nick Carlsen, a former FBI analyst and senior investigator at the blockchain analytics firm TRM Labs. "They cloak themselves in the decentralized terminology, but they are highly centralized. And they profit substantially."

THORChain's American co-founder, Chad Barraford, told a podcast in October that "the protocol has no ability to censor individual transactions or wallets -- the code doesn't even really exist to begin with."

Traditional financial institutions are subject to regulations that require them to screen for and report potential money-laundering activity. Regulators in the past have applied some of those rules to cryptocurrency companies.

But the world of decentralized finance remains largely unregulated, even as scrutiny on its role in money laundering increases.

"It seems to be almost part of the business model [of some crypto services] to offer a way to evade tracing after an exploit, theft or hack," said Scott Armstrong, a partner at Armstrong & Bradylyons and a former federal prosecutor who investigated cryptocurrency cases.

Critics question how decentralized some of these platforms really are, and federal prosecutors have brought charges against operators of some blockchain services, accusing them of knowingly helping criminals launder illicit proceeds and winning some convictions. Users, too, have pressed for accountability.

Last year, investors in a THORChain-based lending protocol created by Barraford and co-founder John-Paul Thorbjornsen sued the two developers, questioning its claim of being decentralized. The suit alleged that Barraford and Thorbjornsen had access to a master key that essentially operated as an override function on the protocol. Thorbjornsen had even used the key to try to stave off the lending protocol's collapse, the investors said.

Barraford, who is based in the U.S., has denied the investors' claims. He didn't respond to a request for comment about THORChain's use in the Binance hack.

In a message on X, Thorbjornsen, a former Australian air force pilot, told The Wall Street Journal that he no longer plays an active role at THORChain. He said developers have since removed the administrative key at the center of the lawsuit and that the network is run by 111 nodes -- run by an undisclosed number of people -- making it "significantly more decentralized" than other protocols.

North Korea, whose state-backed hacking groups have been behind most of the largest crypto heists, has a track record of using THORChain to convert stolen assets into currencies like bitcoin.

After North Korea's $1.5 billion hack of the Dubai-based crypto exchange Bybit last year, hackers used THORChain to facilitate nearly $1 billion in transactions. The laundering earned THORChain operators at least $12 million in fees, according to Chainalysis.

"All blockchain protocols make fees from usage," Thorbjornsen messaged the Journal.

Swaths of the crypto industry have rallied to help Binance recover its funds. Within a few hours of the hack, around half of the stolen funds were frozen as stablecoin issuers like Tether and Circle blacklisted wallets associated with the heist.

But close to $3 billion of the stolen funds still remain in control of the hackers, according to blockchain tracing firms.

Those handling the money moved to break the funds up into smaller and smaller pieces, creating a spider web of transactions that is difficult for experts to track. During this process, funds are moved back and forth across different blockchains and mixing services -- which is where THORChain and Wasabi Wallet come into play.

Last weekend, the FBI called on operators of cryptocurrency services to block activity linked to the Binance hack and explicitly named THORChain's node operators. But THORChain's money-moving machine remains open for business.

Blockchain wallets tied to the Binance heist have also continued to use Wasabi Wallet.

Wasabi Wallet allows for users to move funds between bitcoin wallets without leaving a clear trace, facilitated by a "coordinator."

At present, a single coordinator handles more than 99% of those transactions on Wasabi Wallet, according to a platform that tracks analytics for the protocol.

The coordinator, an American bitcoin developer operating under the pseudonym "Kruw," earns negligible revenues for his work, according to Chainalysis. He didn't respond to recent requests for comment for this article.

In a 2024 appearance, the developer said he was driven to support the privacy platform because of his "anarchocapitalist libertarian" ideological beliefs.

Asked whether he was afraid he might be placing himself in legal jeopardy he said that he has "no interest in what politicians have to say or what regulators have to say," but was clear-eyed about the risks.

"Am I safe? Am I protected by the U.S. Constitution?" he added. "No, we haven't seen that work all the time."