本文为原文前 6,000 字符的节选翻译，完整内容请查看原文。

The $6.3B Binance hack was pulled off in just 20 minutes

Cryptocurrency firms and investigators are racing to freeze and track down billions of dollars of stolen digital cash following what appears to be the largest crypto heist of all time. On Thursday, starting at around 4pm ET, hackers started quickly siphoning around $6.3 billion in cryptocurrencies, spread across multiple blockchains, from wallets belonging to crypto exchange Binance.

在史上最大规模的加密货币盗窃案发生后，加密货币公司和调查人员正争分夺秒地冻结并追踪数十亿美元被盗的数字现金。周四下午4点左右，黑客开始从加密货币交易所币安（Binance）的钱包中迅速窃取约63亿美元的加密货币，这些资金分布在多个区块链上。

Following the theft, Binance almost immediately suspended all deposits and withdrawals from its services as part of its investigation into the hack and says it is working to identify who was behind the breach. The company, along with other crypto firms, says it has so far been able to freeze around half of the stolen funds—essentially stopping hackers moving the money further or trying to cash it out. Much of the remaining crypto may not be possible to freeze, however.

盗窃发生后，币安几乎立即暂停了其服务的所有充值和提现功能，作为黑客攻击调查的一部分，并表示正在努力查明幕后黑手。该公司与其他加密货币公司表示，目前已成功冻结了约一半的被盗资金，从根本上阻止了黑客进一步转移资金或试图套现。然而，剩余的大部分加密货币可能无法被冻结。

Three crypto tracing firms have been quick to link the attack potentially to North Korean hackers. “We think North Korea is likely responsible,” Tom Robinson, chief scientist and cofounder of Elliptic, tells WIRED. “If North Korea is behind it, this one theft would almost double everything the regime has stolen in crypto to date.”

三家加密货币追踪公司迅速将此次攻击与朝鲜黑客联系起来。Elliptic的首席科学家兼联合创始人汤姆·罗宾逊（Tom Robinson）告诉《连线》（WIRED）杂志：“我们认为朝鲜很可能是幕后黑手。如果真是朝鲜所为，单次盗窃的金额几乎相当于该政权迄今为止窃取的所有加密货币总额的两倍。”

The majority of the stolen crypto was taken in a period of around 20 minutes on October 29, according to analysis by crypto tracing firm TRM Labs. Wallets belonging to Binance across at least ten blockchains—including Ethereum, Bitcoin, Tron and Solana—were drained and sent to multiple addresses controlled by a single attacker, according to TRM’s analysis. “Preparation began at least 36 hours before the theft,” TRM says in a blog post. The company says one of the attacker’s wallets received three small withdrawals during a test period, before later expanding the operations.

根据加密货币追踪公司TRM Labs的分析，大部分被盗加密货币是在10月29日约20分钟的时间内被窃取的。TRM的分析显示，币安在至少十个区块链（包括以太坊、比特币、波场和Solana）上的钱包被清空，资金被发送到由单一攻击者控制的多个地址。TRM在一篇博客文章中表示：“准备工作至少在盗窃发生前36小时就开始了。”该公司称，攻击者的一个钱包在测试期间收到了三笔小额提款，随后才扩大了操作规模。

“Early on October 29, the operator deployed a first piece of code for the attack and tested it on two wallets,” TRM says. “Later that day, it rehearsed the final version on a third wallet, then routed the test funds back to itself. Four hours after that rehearsal, the same code was installed on a Binance hot wallet.” Hot wallets are cryptocurrency wallets that are internet connected and allow crypto exchanges to handle customer withdrawals. Analysts say the funds were drained from hot wallets across the impacted blockchains.

TRM表示：“10月29日清晨，操作者部署了第一段攻击代码，并在两个钱包上进行了测试。当天晚些时候，它在第三个钱包上预演了最终版本，然后将测试资金转回自己手中。预演四小时后，同样的代码被安装在币安的一个热钱包上。”热钱包是指连接互联网、允许加密货币交易所处理客户提现的加密货币钱包。分析师称，资金是从受影响区块链上的热钱包中被抽走的。

The tactics used in the hack appear to mimic previous methods used by an elite subset of North Korean hackers, known by the name TraderTraitor. Crypto tracing firms TRM Labs and Chainalysis both say they believe TraderTraitor may be behind the attack, while Robinson says Elliptic hasn’t specifically tied it to the group but sees overlaps in the activity.

此次黑客攻击所使用的策略似乎模仿了朝鲜精英黑客组织“TraderTraitor”此前使用的方法。加密货币追踪公司TRM Labs和Chainalysis均表示，他们认为TraderTraitor可能是此次攻击的幕后黑手，而罗宾逊则表示，Elliptic尚未将其明确归咎于该组织，但观察到了活动上的重叠。

Neither Binance nor law enforcement officials have named any suspected links between the attack and North Korean hackers. Over recent years, North Korean hackers have repeatedly targeted cryptocurrency firms and stolen hundreds of millions in crypto heists. Multiple North Korean hacking groups can target companies in the sector, but TraderTraitor have become specialists, pulling off infrequent but high profile attacks.

币安和执法官员均未指出此次攻击与朝鲜黑客之间存在任何嫌疑联系。近年来，朝鲜黑客多次针对加密货币公司，在多次加密货币盗窃案中窃取了数亿美元。多个朝鲜黑客组织可以针对该行业的公司，但TraderTraitor已成为其中的专家，实施过虽不频繁但备受瞩目的攻击。

Within North Korea’s sprawling hacking operations—often designed to earn money for the highly sanctioned and repressive regime—TraderTraitor has stood out in recent years for its sophistication and targeting of crypto and decentralized finance companies. Last year, the FBI named TraderTraitor as being responsible for the $1.5 billion hack against crypto exchange Bybit.

在朝鲜庞大的黑客行动中（这些行动通常旨在为受到严厉制裁和压制的政权赚取资金），TraderTraitor近年来因其复杂的技术手段以及对加密货币和去中心化金融公司的针对性攻击而脱颖而出。去年，美国联邦调查局（FBI）认定TraderTraitor应对针对加密货币交易所Bybit的15亿美元黑客攻击负责。

Binance did not answer WIRED’s questions about whether it believes North Korean hackers are behind the colossal heist, pointing towards a statement saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.

币安没有回答《连线》杂志关于其是否认为朝鲜黑客是这起巨额盗窃案幕后黑手的提问，而是指向了一份声明，称其将承担黑客攻击造成的所有损失，并正在与执法官员合作查明责任人。

“Our initial investigation suggested that the security incident may have involved a compromised laptop, however, our subsequent investigation has uncovered additional points of breach,” the company says in a statement. “This was a complex attack, and we are doing all we can in coordination with law enforcement to resolve it.”

该公司在声明中表示：“我们最初的调查显示，此次安全事件可能涉及一台被入侵的笔记本电脑，但随后的调查发现了更多的漏洞点。这是一次复杂的攻击，我们正在与执法部门协调，尽一切努力解决问题。”

“These folks in particular are somewhat artists in terms of getting into these distributed finance organizations,” Rafe Pilling, a senior director of threat intelligence at security company Sophos, tells WIRED. “TraderTraitor seems to focus on these larger operations. In the past, they’ve developed their own fake applications and tried to use those to get inside organizations.”

安全公司Sophos的威胁情报高级总监拉夫·皮林（Rafe Pilling）告诉《连线》：“这些人进入这些分布式金融组织的技术堪称艺术。TraderTraitor似乎专注于这些大型行动。过去，他们曾开发自己的虚假应用程序，并试图利用这些程序潜入组织内部。”

TRM and Chainalysis have initially linked the attack to TraderTraitor and say the determinations are based on their analysis of both on-chain and off-chain activity. “​​The strongest evidence emerged when Chainalysis investigators observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit, which had been attributed to North Korean actors,” a research blog from Chainalysis says.

TRM和Chainalysis初步将此次攻击与TraderTraitor联系起来，并表示这些判断是基于他们对链上和链下活动的分析。Chainalysis的一篇研究博客称：“最强有力的证据出现在Chainalysis调查人员实时观察到从币安窃取的资金与上个月Bitget漏洞攻击中窃取的资金混合在一起时，而Bitget攻击已被归咎于朝鲜黑客。”

“Binance says the attack began with a compromised engineer’s laptop. Targeting crypto company staff is a TraderTraitor hallmark,” Elliptic’s Robinson says. “The attacker funded their wallet through Tornado Cash and rehearsed the attack in advance, as in Bybit.”

Elliptic的罗宾逊说：“币安表示攻击始于一名工程师的笔记本电脑被入侵。针对加密货币公司员工是TraderTraitor的标志性手法。攻击者通过Tornado Cash为他们的钱包注资，并像在Bybit事件中一样提前预演了攻击。”

While around $3 billion of cryptocurrency was initially frozen in the aftermath of the attack, it is likely those behind it could still potentially take away huge sums as not all of the stolen crypto can be frozen. Research from Chainalysis says the company is seeing money “laundering patterns we have not seen before” and that thousands of transactions being quickly processed indicates that they are using “automation to obscure the trail of funds.”

虽然在攻击发生后，约30亿美元的加密货币被初步冻结，但幕后黑手仍有可能带走巨额资金，因为并非所有被盗的加密货币都能被冻结。Chainalysis的研究称，该公司观察到了“我们从未见过的洗钱模式”，数千笔交易被快速处理表明他们正在使用“自动化手段来掩盖资金踪迹”。

Elliptic’s Robinson says that around $2.8 billion, or around 44 percent of the total amount stolen, has been frozen by crypto companies and exchanges so far, with almost all of this being stablecoins. “The remaining $3.3 billion is mostly Bitcoin, Ether, and XRP, which no one can freeze,” Robinson says. “It can only be stopped when it reaches an exchange or other service. Some will be caught over

Elliptic的罗宾逊表示，到目前为止，加密货币公司和交易所已经冻结了约28亿美元，即被盗总额的44%左右，其中几乎全部是稳定币。罗宾逊说：“剩下的33亿美元主要是比特币、以太币和瑞波币（XRP），没有人能冻结这些资产。只有当它们到达交易所或其他服务机构时，才能被拦截。有些资金会在……”