Chainalysis said in a post on X that investigators observed a previously unseen laundering pattern in funds stolen from Binance. Thousands of transactions appeared in a short period, which the firm said pointed to the use of automation to hide the trail of funds.
The company said the assets did not move in a one-way flow. Instead, they circulated repeatedly across multiple addresses and were often sent back to addresses that had appeared earlier in the sequence.
Investigation article details timeline and attack method
In an investigation article published the same day, Chainalysis said the Binance theft, estimated at about $6.4 billion, was carried out by the North Korean cybercrime group TraderTraitor. It described the incident as one of the largest thefts in crypto history.
According to the article, funds began leaving Binance hot wallets at about 4:20 p.m. Eastern Time on Oct. 29. The unauthorized transfers, spanning multiple blockchains, totaled about $6.4 billion.
On Ethereum, the attackers used an operational wallet funded through Tornado Cash to submit valid signature authorization, causing Binance hot wallets to execute code deployed by the attackers and sweep assets.
Stablecoin swaps and frozen funds
The article also said the attackers moved $500 million in stablecoins into a wallet used for swaps. In nearly 20 minutes, they exchanged $325 million in stablecoins for $285 million worth of ETH, then sent the remaining $175 million in stablecoins to an intermediary wallet.
Freezing actions began at 5:14 p.m. Eastern Time. As of publication, about $2.8 billion had been frozen.
Repeated on-chain sequence noted
Investigators also observed that multiple addresses first received exactly 1 TRX before receiving and sending out other funds. Chainalysis said this repeated sequence suggested the transfers were programmatic.
The investigation is ongoing.
