Binance hack: Chainalysis flags automated laundering as freezes hit billions
Chainalysis and Elliptic say the Binance attackers are using unusual automated laundering, while issuers froze roughly $3 billion of the stolen funds.
Blockchain analytics firm Chainalysis said on Oct. 30 that the attackers behind the Binance breach are moving stolen funds in ways it has not seen before. According to CryptoSlate and Bitcoin.com News, investigators found thousands of transactions in short windows, which points to automation. Cointelegraph reports that the attackers still control billions of dollars despite freezes by token issuers.
The size of the theft differs by source. CryptoSlate and Cointelegraph put it at about $6.3 billion, while Bitcoin.com News says Chainalysis estimated $6.4 billion. Both describe it as the largest crypto theft on record.
Automated patterns and a race against freezes
Chainalysis said stolen assets were passed among linked addresses and sometimes returned to wallets used earlier in the sequence. On Tron, many wallets first received exactly 1 TRX, then accepted more funds and forwarded them. Chainalysis said the repeated sequence suggests a programmatic process, and CryptoSlate notes it could force analysts to sift through thousands of overlapping transfers.
Cointelegraph reports that the attack began at 8:04 pm UTC on Thursday and that the aim was to swap freezable tokens such as USDT and USDC for assets like ETH that have no issuer. CertiK engineer Dickson Wu traced $500 million in USDT to one address, with $325 million sold for ETH within an hour. Bitcoin.com News, citing Chainalysis, says that wallet swapped $325 million in stablecoins for about $285 million in ether over nearly 20 minutes. It dates the outflows to about 4:20 p.m. Eastern on Oct. 29, and the two outlets give slightly different timelines.
What was converted and what was frozen
Elliptic, cited by CryptoSlate, said the attackers converted about $786 million in stolen stablecoins into ETH and TRX before freezes took hold. On Ethereum, about 434 million USDT became 160,451 ETH through Uniswap, 1inch and market maker quote systems, at prices 12% to 26% worse than market rates. Another 234 million USDT was swapped for 638 million TRX on SunSwap, and $48 million in RLUSD was sold.
Cointelegraph says Tether froze about $1.567 billion in USDT, the first major freeze coming 37 minutes after funds reached the main attacker wallet. Circle froze about $823 million in USDC three minutes later. Arbitrum's Security Council also moved about $30.5 million in ARB and ETH to a frozen wallet. Binance said about $3 billion was frozen, while Chainalysis counted about $2.8 billion in its Oct. 30 account.
Cointelegraph stresses that frozen funds are not recovered funds, since a freeze stops spending but does not return money to Binance or its users. It also reports that an attacker-linked wallet deposited $60 million in USDT into Aave V3 and borrowed $44.6 million in WETH. Aave said the position stayed overcollateralized and did not put suppliers at risk.
Attribution, Bitcoin and what to watch
Chainalysis attributed the hack to the North Korean group Tradertraitor after seeing stolen Binance assets mix with proceeds from September's Bitget theft. According to Bitcoin.com News, TRM Labs also attributed it to the group with high confidence. Chainalysis also identified an Ethereum wallet funded through Tornado Cash. Binance co-CEO Richard Teng disclosed further breach points, per Bitcoin.com News.
Elliptic found 18,270 BTC split across 19 addresses, most holding about 1,000 BTC. As of Oct. 30, none had reached an identified exchange or service. Elliptic expects more stolen assets to move through additional wallets and cross-chain routes.
Binance said it reserved more than $6.34 billion to cover the incident, with $5 billion already held in affected tokens. Traders may want to watch whether the Bitcoin addresses become active, whether more freezes follow, and how Binance's tracing with law enforcement progresses.
Sources
- Binance hackers deploy never-seen-before laundering tactics to conceal $6.3 billion theft CryptoSlate
- Binance hackers raced to move billions before it could be frozen Cointelegraph
- Binance Hackers Deploy ‘Never-Seen-Before’ Crypto Laundering Tactics Bitcoin.com News
Written with AI assistance from the sources above and checked against them. Not investment advice.