DPRK Linked Hackers Suspected in $40 Million Crypto Heist

Plus, How Meta is Securing Messenger

Aug 24, 2023

The FBI has issued a warning regarding the potential for North Korean-affiliated threat actors to convert stolen cryptocurrency valued at more than $40 million into cash. The agency identified the group behind this blockchain activity as TraderTraitor, also known as Jade Sleet. An investigation revealed that the group transferred around 1,580 bitcoins from various cryptocurrency heists within the last 24 hours, currently holding these funds in six separate wallets.

TraderTraitor is notorious for targeting blockchain and cryptocurrency exchanges to accumulate digital assets for North Korea, a country that often blurs the lines between cyber warfare, espionage, and financial crime. Their actions include major thefts from Alphapo, CoinsPaid, and Atomic Wallet in June 2023, alongside attacks on Ronin Network and Harmony Horizon Bridge last year.

TraderTraitor's activities overlap with another North Korean group, APT38, and are part of the larger Lazarus constellation. Recently, Google-owned Mandiant linked TraderTraitor to UNC4899, a hacking crew associated with the JumpCloud breach in June 2023. Since 2018, North Korean hackers, including TraderTraitor, are estimated to have stolen over $2 billion in cryptocurrencies through approximately 30 attacks, with $200 million taken in 2023 alone.

The FBI advises private sector entities to scrutinize the blockchain data tied to these addresses and exercise caution when dealing with transactions originating from or linked to these addresses.

Meta Sets Up Default End-to-End Encryption for Messenger

Meta (formerly Facebook) has reaffirmed its commitment to introducing end-to-end encryption (E2EE) by default for one-to-one friends and family chats on Messenger by the end of the year. The company started expanding E2EE to users in January 2023 and has been upgrading millions more users' chats with this feature since August 22, 2023. This move aligns with CEO Mark Zuckerberg's privacy-focused vision for social networking, announced in 2019, though technical challenges led to a one-year delay in implementation.

Messenger's previous design operated via servers, but the addition of encryption required a redesign to ensure messages could be sent securely while maintaining timely delivery. Meta implemented Hardware Security Modules (HSM) to uphold E2EE and enable users to access their message history using a PIN.

Meta rebuilt over 100 Messenger features to maintain encryption safeguards, including sharing links to external sites like YouTube. With E2EE, preview data from external sites is fetched by the Messenger app, encrypted as a whole, and sent to recipients.

While law enforcement agencies have concerns about default E2EE hindering criminal investigations, it is valued as a means of safeguarding personal communications against leaks or unauthorized surveillance.

As the transition to E2EE continues, users will need to update their Messenger app to access the default E2EE service. This process will take longer than initially expected due to the scale of testing and implementation.