The hackers who stole a record US$6.3-billion from crypto exchange Binance are moving the money in ways never seen before, according to blockchain analytics firm Chainalysis.
Chainalysis said the attackers fired off thousands of transactions in a short time. It said this looks like an automated effort to hide the trail of the stolen funds.
“We are observing never-seen-before laundering patterns,” Eric Jardine, head of research at Chainalysis, said in a statement. “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
Jardine said the hackers keep moving the money between addresses, often sending it back to wallets used earlier. Many addresses first get exactly 1 TRX, the token of the Tron blockchain, before receiving more funds and passing them on.
He said this pattern “suggests a programmatic process for moving and redistributing the stolen funds”. Chainalysis has not said that artificial intelligence is involved, only that the laundering is automated.
In the first minutes of the theft, the attacker raced against stablecoin issuers such as Tether and Circle, which can freeze their tokens. Over nearly 20 minutes, it swapped $325-million in stablecoins for $285-million in ether, which no issuer can freeze, Chainalysis said.
Freezes had started by 11.14pm South African time on 29 October, less than an hour after the theft began. Chainalysis puts the frozen total at about $2.8-billion. Binance has said it has located about $3-billion.
On Saturday, the FBI said North Korea was behind the theft of “more than $6-billion”. It called the activity TraderTraitor and said the hackers were turning stolen assets “primarily into ethereum”. The FBI urged crypto firms to block transactions linked to a list of addresses it published.
US President Donald Trump said later on Saturday that it was still unclear whether North Korea was involved, Reuters reported. He told reporters that if it was North Korea, the US would talk to North Korea about it. Pyongyang has long denied using state-linked cyber units to steal money.
Chainalysis, which puts the haul at about $6.4-billion, said its strongest evidence came when its investigators saw Binance funds mixing with money stolen in the Bitget hack in September. That theft had been blamed on North Korea.
Binance began restoring withdrawals in phases at 8am South African time on Sunday. By 5.30pm it had processed $4.65-billion in withdrawals and $1.01-billion in deposits. Binance said the net outflow of $3.64-billion was 2.1% of its $171-billion in assets.
“After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial,” Binance said in a post on X.
Analytics platform DefiLlama showed higher outflows, first $4.36-billion and later $5.81-billion, Reuters reported on Monday. Binance told the news agency the first figure left out funds it had moved to its own new hot wallet.
Binance said on Sunday it had replaced about 95% of the stolen assets after setting aside more than $6.34-billion of its own money. Binance Africa told TechCentral the money came from its corporate treasury, its Secure Asset Fund for Users and part of its futures insurance fund.
The exchange has also changed its account of the breach. It first pointed to a hacked engineer’s laptop, but co-CEOs Yi He and Richard Teng said on 30 October that further points of breach had been found.
Binance has promised to publish a report on the incident once its investigation is complete.
Source: this article is based on reporting by TechCentral. Image: TechCentral. Written with the help of AI and published by the Tzaneen Voice Technology desk. See our Editorial Standards.
Werner Jacobs covers technology for Tzaneen Voice. Werner reports on mobile networks, data prices, internet access, smartphones, apps, AI, cybersecurity and South African tech companies. Each story explains what a new product, price change or policy means for ordinary users in South Africa.