Hackers behind the $6.4 billion Binance-related cryptocurrency theft have adopted unusual money-laundering techniques, rapidly circulating stolen funds through thousands of transactions in an apparent effort to evade detection.
According to blockchain analytics firm Chainalysis, investigators identified previously unseen transaction patterns involving repeated transfers between thousands of cryptocurrency addresses.
The activity suggests the attackers are using automated processes to move the stolen assets through an increasingly complex network of wallets.
Advertisement
Unusual laundering activity
In an October 30 investigation titled The $6.4 Billion Binance Hack: Tracing the North Korea Link, Chainalysis highlighted several unusual characteristics of the laundering operation, including repeated fund circulation and a distinctive transaction pattern involving exactly 1 TRX.
The firm observed wallets receiving 1 TRX before accepting larger amounts of stolen cryptocurrency and forwarding the funds to other addresses.
The repeated sequence suggests a programmed approach to distributing assets and complicating blockchain tracing efforts.
The investigation also identified rapid conversions of stolen stablecoins into other cryptocurrencies, potentially allowing the attackers to move funds before issuers could freeze the assets.
In one instance, approximately $500 million in stablecoins was transferred to a designated conversion wallet.
Of that amount, roughly $325 million was exchanged for approximately $285 million worth of Ethereum (ETH) within nearly 20 minutes. Another $175 million was subsequently moved through intermediary wallets.
Advertisement
“Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets,” Chainalysis said.
Chainalysis said the activity demonstrated the speed and complexity of the operation, with the attackers attempting to move assets across multiple addresses while avoiding intervention from cryptocurrency platforms and stablecoin issuers.
North Korean hackers suspected
Chainalysis attributed the attack to TraderTraitor, a North Korean-linked cybercrime group associated with cryptocurrency thefts.
Investigators also identified connections between the Binance-related proceeds and funds stolen during the previous month’s Bitget exploit.
The on-chain overlap provided additional evidence supporting the suspected North Korean connection.
The laundering activity has prompted efforts to freeze and recover the stolen assets. Chainalysis reported approximately $2.8 billion in frozen funds in its October 30 investigation, while Binance subsequently put the figure at approximately $3 billion.
Advertisement
Binance has also said it reserved more than $6.34 billion in company funds to cover the incident, underscoring the financial scale of the reported theft.
Featured image via Shutterstock
