專家：涉嫌加密貨幣竊案的北韓駭客是全球頂尖駭客之一

AJ 維森斯報導By AJ Vicens

10月30日（路透社）— 資安專家週五表示，可能是加密貨幣交易所幣安創紀錄63億美元竊案幕後黑手的北韓駭客，是全球最活躍的加密貨幣竊賊之一，而竊得款項有助於資助該國的武器計畫。Oct 30 (Reuters) - North Korean hackers likely behind the record $6.3 billion theft from cryptocurrency exchange Binance are among the world's most prolific crypto thieves, and the proceeds help fund the country's weapons programs, cybersecurity experts said on Friday.

區塊鏈調查公司 TRM Labs 與 Chainalysis 將這起竊案歸因於一個名為「TraderTraitor」的北韓駭客組織。這個名稱曾出現在美國聯邦調查局（FBI）、美國網路安全暨基礎設施安全局（CISA）和美國財政部2022年發布的聯合警告中，該警告描述駭客如何利用惡意軟體和其他手法，鎖定加密貨幣公司的軟體開發人員與 IT 員工。Blockchain investigation firms TRM Labs and Chainalysis attribute the heist to a North Korean hacking group known as “TraderTraitor,” a name used in a 2022 joint warning from the FBI, CISA and US Treasury that described how hackers used malicious software and other tricks to target software developers and IT staff at cryptocurrency companies.

Chainalysis 在2025年12月的一份報告中表示，截至2025年底，北韓至少竊取了67.5億美元的加密貨幣。這項總額包括2025年2月 ByBit 交易所遭駭的15億美元。North Korea stole at least $6.75 billion in cryptocurrency through the end of 2025, Chainalysis said in a December 2025 report. That total includes the $1.5 billion ByBit exchange hack in February 2025.

專家表示，該組織也攻擊了另一家交易所 Bitget，於9月竊取3.87億美元。資安公司 DTEX 研究員麥可・巴恩哈特（Michael Barnhart）表示，這使北韓竊取加密貨幣的最低總額達到約135億美元。The group also hit Bitget, a separate exchange, taking $387 million in September, experts have said, bringing the minimum total of cryptocurrency North Korea has stolen to roughly $13.5 billion, said Michael Barnhart, a researcher with cybersecurity firm DTEX.

幣安表示，該公司與其他人正努力凍結部分遭竊加密貨幣，目前已找到約30億美元。Binance said it and others were working to freeze some of the stolen cryptocurrency, with about $3 billion located so far.

巴恩哈特說：「Bitget 事件後，社群中很多人都預期會發生類似情況。」“After Bitget, a lot of the community expected something like this,” Barnhart said.

他並補充說，TraderTraitor 是北韓「最有能力的駭客組織，主要專注於金融領域，成員包括該政權網路計畫中、前 APT38 行列裡一些最有經驗的操作者」。他指的是北韓長期運作、以金融為目標的駭客單位。TraderTraitor is North Korea’s “most capable hacking group with a primary focus on financials and one staffed by some of the most experienced operators in the regime’s cyber programs in the former APT38 ranks,” he added, referring to North Korea’s long-running financially focused hacking units.

研究人員表示，TraderTraitor 透過惡意軟體或假工作機會，鎖定金融機構的開發人員和 IT 員工，在假面試中誘騙求職者下載惡意軟體，讓駭客取得登入憑證和其他敏感資料。Researchers say TraderTraitor targets developers and IT staff at financial institutions through malware or phony job offers, tricking candidates into downloading malicious software during fake job interviews, giving the hackers access to login credentials and other sensitive data.

Sophos 威脅研究資深總監拉夫・皮林（Rafe Pilling）表示，關於駭客如何入侵幣安的初步報告，符合北韓一貫手法；這個組織也非常擅長摸清一家公司的系統與員工如何核准資金轉移。他說：「就滲透這些分散式金融公司而言，這個組織尤其堪稱高手。」Rafe Pilling, a senior director of threat research at Sophos, said early reports of how the hackers compromised Binance match the North Korean playbook, and that the group is expert at working out how a company's systems and staff approve money transfers. "This group in particular are somewhat artists in terms of getting into these distributed finance companies," he said.

從加密貨幣竊盜到武器資金FROM CRYPTO THEFT TO WEAPONS FUNDING

巴恩哈特表示，駭客竊取資金後，會將款項交給中國組織犯罪洗錢集團。After stealing the money, the hackers pass it to Chinese organized crime money-laundering groups, Barnhart said.

美國聯邦調查局在10月13日發布的公益公告中表示，北韓人也祕密在美國和其他國家的科技與金融公司任職，以賺錢匯回北韓政府並竊取敏感資料。公告並稱，這些工作者和駭客籌得的資金，有助於資助北韓核子與軍事計畫。North Koreans also secretly take jobs at tech and financial companies in the US and other countries to earn money to send back to the North Korean government and steal sensitive data, the FBI said in an October 13 public service announcement, adding that money raised by the workers and hackers helps fund North Korean nuclear and military programs.

美國國務院一名發言人表示，北韓網路犯罪是「全球性問題」，該國「愈來愈多地轉向網路犯罪，以規避國際制裁，並資助其非法的大規模毀滅性武器與彈道飛彈計畫。加密貨幣竊案與洗錢已成為這項策略的重要一環。」A US State Department spokesman said North Korean cybercrime is a “global problem” and that the country has “increasingly turned to cybercrime to circumvent international sanctions and fund its unlawful weapons of mass destruction and ballistic missile programs. Cryptocurrency heists and laundering have become a significant part of this strategy.”

北韓領導人金正恩已要求該國在無人機和其他軍事技術上取得「絕對優勢」。巴恩哈特表示，北韓無人機計畫的進展，與這些竊案及海外 IT 工作者計畫有直接關聯。North Korean leader Kim Jong Un has called for the country to seize "absolute superiority" in drone and other military technology, and the drone program's gains are directly tied to the heists and the overseas IT worker schemes, Barnhart said.

他並補充說，該國也正在協助俄羅斯的戰爭行動。The country is also aiding Russia’s war effort, he added.

巴恩哈特說：「北韓已向俄羅斯派遣部隊，並提供彈藥和武器零組件，這一切都由同一套系統資助；也因此，加密貨幣駭案是國家安全問題，而不只是遭攻擊交易所的問題。」“North Korea has sent troops, munitions, and weapons components to Russia, all funded through the same system, which is why a crypto hack is a national security issue and not only a problem for the exchange that got hit,” Barnhart said.

（AJ 維森斯底特律、賽門・路易斯華盛頓報導。）(Reporting by AJ Vicens in Detroit and Simon Lewis in Washington.)