Binance Hack Investigators Identify Automated Laundering and Suspected North Korean Links
Blockchain analytics firm Chainalysis has identified unusual, potentially automated money-laundering patterns involving funds stolen in a Binance exploit estimated at $6.4 billion. The firm said on Oct. 30 that investigators had observed transaction sequences it had not encountered before, while tracing activity that may connect the attack to a North Korean cybercrime group.
The investigation also revealed rapid stablecoin conversions apparently designed to move funds into assets that cannot be frozen through issuer-controlled blacklist mechanisms. Chainalysis reported that about $2.8 billion had been frozen by Oct. 30, while Binance separately estimated the total at approximately $3 billion.
Repeated Transfers Point to Automated Crypto Laundering
Chainalysis said investigators detected thousands of transactions within a short period, with funds repeatedly moving between addresses. Some transfers returned assets to wallets that had already appeared earlier in the transaction sequence, a pattern consistent with an automated process intended to complicate tracking.
Investigators also observed that many addresses received exactly 1 TRX, the native token of the Tron network, before receiving larger amounts and forwarding funds elsewhere. The small initial transfers may have formed part of a repeated transaction sequence.
“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” Chainalysis said.
The firm added: “This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.”
Investigation Points to Possible North Korean Involvement
Binance co-CEO Richard Teng disclosed additional points of compromise, approval controls that were bypassed and a self-destruct mechanism that destroyed tools and traces associated with the incident.
Chainalysis traced fund outflows to approximately 4:20 p.m. Eastern time on Oct. 29. Investigators identified an Ethereum wallet funded through Tornado Cash, a cryptocurrency mixer designed to obscure connections between deposits and withdrawals.
The wallet submitted valid cryptographically signed authorizations that enabled a Binance hot wallet to execute software deployed by the attacker and transfer assets to addresses under the attacker's control.
The laundering patterns initially suggested possible involvement by Tradertraitor, a North Korean cybercrime group. Chainalysis subsequently observed stolen Binance assets mixing with proceeds from September's Bitget theft, which had previously been attributed to North Korean actors. The overlap strengthened Chainalysis' attribution of the Binance incident to Tradertraitor.
Separately, blockchain intelligence firm TRM Labs attributed the attack to Tradertraitor with high confidence, citing both on-chain and off-chain intelligence. The findings represent the firms' assessments of the incident rather than a publicly established legal determination.
Stablecoin Conversions Sought to Avoid Freezes
Chainalysis said the attacker moved $500 million in stablecoins into a wallet used to exchange assets that could be frozen by issuers for assets without the same issuer-controlled restrictions.
“Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets,” the firm said.
Some stablecoin issuers can freeze or blacklist designated addresses, preventing affected tokens from being transferred. Native ether does not have an equivalent issuer-controlled mechanism.
Over a period of nearly 20 minutes, the wallet exchanged $325 million in stablecoins for approximately $285 million in ether. About 10 minutes later, the remaining $175 million was moved to intermediary wallets.
Freezes began by 5:14 p.m. Eastern time on Oct. 29. In its Oct. 30 account, Chainalysis reported that approximately $2.8 billion had been frozen. Binance gave a separate estimate of about $3 billion in frozen assets that day.
Binance Sets Aside More Than $6.34 Billion
Binance said it had reserved more than $6.34 billion in company funds to cover the incident, excluding assets that had been frozen. Of that amount, $5 billion was already held in the affected tokens.
The reported figures provide separate measures of the response: funds reserved by Binance to cover the incident and assets frozen during efforts to restrict the movement of stolen cryptocurrency. The available information does not establish that these amounts are interchangeable or that all stolen assets have been recovered.
source: news.bitcoin
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.