Researchers say WannaCry operator moved bitcoins to “untraceable” Monero

When the master or masters of the WannaCry cryptoransomware worm emptied the bitcoin wallets associated with the malware earlier this week, they apparently did so to make future movement of the funds more anonymous. According to researchers at the Italian information security firm Neutrino, the bitcoin were exchanged for XMR, the "untraceable" private digital currency backed by Monero.

On Wednesday, the 52.2 bitcoins in the wallet were drained out over nine transactions, as detected by a bot created by Quartz's Keith Collins. Neutrino researchers traced the moved bitcoins to wallets associated with Monero.

Monero is a private digital currency that is focused on anonymity. While it is based on blockchain like other cryptocurrencies and uses distributed consensus for all transactions to prevent wallet hacking, it uses "ring signatures"—an anonymous cryptographic signature scheme—to sign transactions. This makes it impossible to tell which parties were involved in a transaction when examining the blockchain itself.

Monero has drawn the attention and endorsement of another party at least tangentially tied to the WannaCry worm—the individual or group behind Shadowbrokers, the entity responsible for leaking the NSA exploit used by WannaCry's author. In June, the Shadowbrokers announced that they were now accepting Monero for payments for their "Monthly Dump Service."

There's no evidence directly connecting WannaCry with the Shadowbrokers. Some researchers have associated parts of the WannaCry malware with the Lazarus Group, a hacking group previously associated with the Sony Pictures "wiper" attack and the Swift funds transfer hack of Bangladesh Central Bank. Intelligence officials have tied the Lazarus Group to North Korea's government.