Blockchain analytics firm Chainalysis has identified a “never-seen-before” money-laundering pattern in the aftermath of the $6.4 billion Binance hack. Thousands of transactions conducted within a short period suggest the attackers are using automation to obscure the trail.
Chainalysis calls the theft the largest in crypto history and attributes it to North Korean group TraderTraitor. About $2.8 billion has been frozen so far, while the attackers continue attempts to move the remaining assets.
An Unusual Laundering Pattern Emerges
According to a Chainalysis report, rather than simply moving the funds onward, the attackers repeatedly circulate them among addresses, often sending them back to addresses involved earlier in the sequence.
Sponsored
Investigators have also identified a recurring pattern involving TRON (TRX). Many involved addresses first receive exactly 1 TRX before receiving additional funds and forwarding them elsewhere.
Chainalysis believes these repeated sequences point to a programmatic operation rather than manual transfers. The thousands of transactions suggest automation is being used to distribute the stolen assets and complicate blockchain tracing.
How the $6.4 Billion Binance Exploit Unfolded
The attack against Binance began around 4:20 p.m. Eastern Time on October 29, when unauthorized transfers started draining Binance hot wallets across multiple blockchains.
On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations. These permissions allowed a Binance hot wallet to execute attacker-deployed code, which was subsequently used to transfer its assets into wallets controlled by the attackers.
Chainalysis attributes the operation to TraderTraitor, a North Korean cybercrime group. The analytics firm said its strongest evidence came from observing the stolen Binance funds mixing in real time with assets from last month’s Bitget exploit, which had also been attributed to North Korean actors.
$2.8 Billion Frozen as Attackers Race to Convert Assets
The hackers rushed to convert stolen stablecoins, which issuers can freeze, into cryptocurrencies like ETH, which cannot be frozen.
They moved $500 million into a conversion wallet, swapping $325 million for $285 million in ETH within 20 minutes and transferring the remaining $175 million to stopover wallets.
Stablecoin freezes began at 5:14 p.m. ET, as investigators, law enforcement agencies, stablecoin issuers and other industry participants coordinated efforts across multiple blockchains to restrict the movement of stolen funds. Approximately $2.8 billion had been frozen so far.
Dive into DailyCoin’s hottest crypto news today:
Bitcoin Price Under Pressure After Binance Hack: Traders Eye Lower Levels
Binance Hack: $6.3B Stolen in Largest Crypto Heist, $2.7B Frozen