Notorious hacker says stolen crypto is like ‘holding a hot potato’

Dan Kitwood/Getty Images

On Thursday, Binance, the world’s largest crypto exchange, saw more than $6 billion hacked from its system . Evidence pointed to North Korean hackers , who drained the accounts in a matter of minutes.

But what does a hacker do with billions of dollars in stolen crypto?

Perhaps no one on the planet is more qualified to discuss the hack than Ilya Lichtenstein, the notorious hacker who in 2023, alongside his wife, Heather Morgan, pleaded guilty to orchestrating a $4.5 billion money-laundering scheme linked to the 2016 hack of crypto exchange Bitfinex. In 2024, Lichtenstein was sentenced to five years in prison, but he was released early this January. He now says that he has switched sides and is working as a “white hat” hacker trying to stop cyberattacks.

On Thursday, Binance, the world’s largest crypto exchange, was hacked with more than $6 billion being wiped out. CNN’s Jon Sarlin talks with notorious hacker Ilya Lichtenstein, who once stole $4.5 billion worth of crypto, about the challenges that both law enforcement and the hackers are now facing.

CNN talked with Lichtenstein about how hacking an exchange can be easier than actually laundering the crypto and how rapid AI advancements will inevitably lead to drained crypto wallets.

This interview has been edited for clarity.

This does fit the North Korean modus operandi. So, typically, they go for the weakest link. They’re not going to attack, like, Binance.com the website, because they have a lot of security there. But there might be an employee who is vulnerable to phishing who might be tricked into downloading a virus. And I think as a defender, you need to be aware of, “Where is the weakest link in the chain?” It’s not enough to just secure the front door, you have to secure all the entrances, the doors and the windows.

You may have heard that if you’re trying to investigate a murder, your best chance is in the first 48 hours. It’s kind of the same with crypto. Right now, all of these funds are moving and getting split, split, split into small pieces and shuffled around and moved together. And because AI agents can do this, it’s happening incredibly quickly. And so it’s really a race against time to just try to catch up and trace it before it grows exponentially harder to trace.

They’re probably feeling a little nervous, if I had to guess, because there are a lot of eyes on that Bitcoin. It’s all on a blockchain that is publicly visible. Anyone can investigate it. And there are very, very sophisticated blockchain analysis tools right now. And, as we’ve seen, a lot of these crypto platforms — such as Tether/USD, for example — have the ability to freeze funds. They’re not truly decentralized.

And so what these hackers have to do is extremely quickly try to basically hide the trail, try to obfuscate this money. Try to mix it around, move it around. And their main goal is just to be able to move some amount of the funds quickly enough so that it doesn’t get frozen or they don’t get caught. And there are a lot of very perilous steps for them along the way of that.

They’re holding a hot potato. So, these hackers in turn will have to try to move even faster to basically somehow take this money and either exchange it for legitimate money or mix it into a pile of money where you can’t tell what’s counterfeit and what’s legitimate. It’s very tricky for them. I think they’re in a hard spot.

The hardest part is after the hack because there are a lot of eyes on all of that crypto, and you have to launder it very quickly before you get caught.

It’s very difficult to launder that kind of money. I know it’s hard to believe, but I wasn’t super motivated by money. I was always more interested in the technical challenge, and so I didn’t spend very much of it. And I think that that’s been reflected in court records. So, I didn’t have to fully cash out or launder a great amount of it, which I think made it easier for me.

But essentially, what I did is I registered accounts at a bunch of crypto exchanges, some using my identity, some using money mules or fake identities, and then I structured it into kind of small deposits that I deposited to trickle a little bit, and I exchanged it into other cryptocurrencies. That’s called “chain hopping.”

And so the goal is for anyone who’s kind of doing this kind of laundering, is all of the coins can be traced on one blockchain. If you switch it to another blockchain, that breaks up the trail. So, for example, if I have Ethereum and then I exchange it into Bitcoin or something, that’s like a separate trail, and investigators may or may not be able to link the two. And furthermore, if you kind of break this up into multiple small pieces, maybe using different identities or different exchanges, that is a lot less likely to trigger money laundering controls. I think the kind of unique, exciting and scary part of this whole thing is that now we’re in the age of AI. And so now all of this stuff can be automated at like an insane machine speed.

Terrifying. It’s terrifying, and I wouldn’t recommend it to anyone.

And I think in general, like, crime is absolutely not worth it. Like, even if it seems cool, it is not worth the stress and the damage that it could do to your life and the long-ranging consequences. Once something is on the blockchain. It’s written there forever. Someone can go back years later with better technology — because the technology keeps improving — and they can trace it. And they will catch you, and that’s usually what happens.

Absolutely, absolutely. Because the rate of advancement of AI has been incredible. Even this past year, the security capabilities of models have grown tremendously. And so right now, there are frontier models from OpenAI and Anthropic that are capable of very, very advanced hacking. But those models are kept under lock and key. There are a lot of safeguards. But then there are also open-source models that are coming out of places like China, where they’re not quite as advanced at hacking yet, but they probably are about three to six months behind.

So in a few months, you can have open-source models that anyone can download that are better at hacking than the best hackers in the world. And I think potentially that’s very dangerous. Right now, it’s maybe in the hands of nation-state North Korean-type hackers. In a few months, the same hacking technology that enables something like this could be in the hands of a kid in their basement who is bored.

Editor’s note: CNN reached out to North Korea’s mission at the UN for comment about the hacking allegations. Pyongyang has previously denied hacking allegations.

In a statement on Saturday, Binance said it has covered “90%” of the stolen funds for customers and are “on track to resume withdrawals within the previously stated timeframe.”

CNN’s Sean Lyngaas contributed to this report.

Dan Kitwood/Getty Images

周四，全球最大的加密货币交易所币安的系统遭到黑客攻击，损失超过60亿美元。证据指向朝鲜黑客，他们在短短几分钟内就盗空了所有账户。

但是，黑客会如何处理被盗的价值数十亿美元的加密货币呢？

或许地球上没有人比伊利亚·利希滕斯坦更适合讨论这次黑客攻击事件。这位臭名昭著的黑客曾于2023年与妻子希瑟·摩根一起承认策划了一起与2016年加密货币交易所Bitfinex遭黑客攻击有关的45亿美元洗钱计划。2024年，利希滕斯坦被判处五年监禁，但于今年1月提前获释。如今，他声称自己已经改邪归正，成为一名“白帽”黑客，致力于阻止网络攻击。

周四，全球最大的加密货币交易所币安遭到黑客攻击，超过60亿美元的资金被盗。CNN记者乔恩·萨林采访了曾窃取价值45亿美元加密货币的臭名昭著的黑客伊利亚·利希滕斯坦，探讨了执法部门和黑客目前面临的挑战。

CNN 与利希滕斯坦讨论了黑客攻击交易所比实际洗钱更容易的原因，以及人工智能的快速发展将如何不可避免地导致加密货币钱包被掏空。

为了行文清晰，本次采访内容经过编辑。

这确实符合朝鲜的作案手法。通常情况下，他们会选择攻击最薄弱的环节。他们不会直接攻击像 Binance.com 这样的网站，因为那里的安全措施非常完善。但可能会有员工容易受到网络钓鱼攻击，从而被诱骗下载病毒。我认为作为防御者，你需要时刻注意“链条中最薄弱的环节在哪里？”仅仅加固大门是不够的，你必须确保所有入口、门窗的安全。

你可能听说过，调查谋杀案的最佳时机是案发后的前48小时。加密货币的情况也类似。目前，所有这些资金都在不断流动、分裂、再分裂，被分割成无数小块，然后重新组合转移。由于人工智能代理可以做到这一点，整个过程发生得极其迅速。因此，这实际上是一场与时间的赛跑，必须在追踪难度呈指数级增长之前赶到现场。

如果让我猜的话，他们可能有点紧张，因为比特币受到了很多关注。它完全记录在公开的区块链上，任何人都可以进行调查。而且现在有很多非常先进的区块链分析工具。正如我们所看到的，很多加密货币平台——例如Tether/USD——都有权冻结资金。它们并非真正去中心化。

因此，这些黑客必须以极快的速度试图掩盖踪迹，混淆资金来源，将资金混杂转移。他们的主要目标是尽快转移一部分资金，以免被冻结或被抓获。在这个过程中，他们需要经历许多极其危险的步骤。

他们现在就像拿着烫手山芋。所以，这些黑客反过来就得加快速度，想办法把这些钱弄到手，要么换成真钱，要么混入一堆真假难辨的钞票里。这对他们来说非常棘手。我觉得他们处境艰难。

最难的部分是黑客攻击之后，因为所有这些加密货币都会受到密切关注，你必须在被抓之前迅速洗白。

洗钱非常困难。我知道这很难让人相信，但我并非一心追求金钱。我一直更感兴趣的是技术上的挑战，所以我并没有花掉很多钱。我认为这一点在法庭记录中也有所体现。因此，我不需要全部套现或洗钱，这对我来说反而更容易。

但本质上，我所做的就是在很多加密货币交易所注册账户，有些是用我的真实身份，有些是用洗钱者或虚假身份，然后我把资金分成小额存款，一点一点地存入，再兑换成其他加密货币。这叫做“链跳”。

所以，对于任何进行这种洗钱活动的人来说，最终目标是确保所有加密货币都能在同一个区块链上被追踪。如果切换到另一个区块链，追踪线索就会中断。例如，如果我持有以太坊，然后将其兑换成比特币或其他加密货币，这就形成了一条独立的追踪线索，调查人员可能能够也可能无法将这两条线索联系起来。此外，如果将交易拆分成多个小部分，例如使用不同的身份或不同的交易所，那么触发反洗钱监管的可能性就会大大降低。我认为这件事独特、令人兴奋又令人担忧的地方在于，我们现在正处于人工智能时代。因此，所有这些操作都可以以惊人的速度实现自动化。

太可怕了。真的太可怕了，我不会推荐给任何人。

总的来说，我认为犯罪绝对不值得。即使它看起来很酷，但它带来的压力、对生活造成的伤害以及长远的后果，都得不偿失。一旦犯罪记录被上传到区块链，就永远无法更改。多年以后，人们可以利用更先进的技术——因为技术一直在进步——追溯到犯罪记录。他们最终会抓到你，而这通常也是最终的结果。

当然，绝对没错。因为人工智能的发展速度令人难以置信。即使在过去一年里，模型的安全能力也得到了极大的提升。所以现在，OpenAI 和 Anthropologie 等公司推出的前沿模型已经能够进行非常非常高级的黑客攻击。但这些模型都被严密保护起来，有很多安全措施。与此同时，也有一些来自中国等地的开源模型，它们的黑客攻击能力虽然还不如 OpenAI 和 Anthropologie 先进，但可能也落后三到六个月。

所以几个月后，任何人都可以下载开源模型，这些模型比世界上最顶尖的黑客还要厉害。我认为这非常危险。现在，这种技术可能掌握在像朝鲜那样的国家级黑客手中。几个月后，同样的黑客技术可能落入一个无聊的地下室孩子手中。

编者按：CNN已就黑客指控联系朝鲜常驻联合国代表团寻求置评。平壤此前已否认黑客指控。

币安周六发表声明称，已为客户支付了“90%”的被盗资金，并“有望在之前规定的时间内恢复提现”。

CNN的肖恩·林加斯对本报道亦有贡献。