Chainalysis: Binance's stolen funds have shown an unprecedented automated money laundering pattern

Blockchain data analysis company Chainalysis stated on X that investigators observed previously unseen money laundering patterns in the stolen funds from Binance. Thousands of transactions appeared in a short period, indicating that the attackers were using automated methods to obscure the trail of funds. The funds were not transferred in a single direction but circulated repeatedly among multiple addresses, often being sent back to addresses that had appeared earlier in the sequence.

In an investigative article released the same day, the company assessed that the theft of approximately $6.4 billion from Binance was carried out by the North Korean cybercrime organization TraderTraitor, calling it one of the largest thefts in cryptocurrency history. The article noted that around 4:20 PM Eastern Time on October 29, funds began to flow out of Binance's hot wallet, involving multiple blockchains, with a total unauthorized outflow of approximately $6.4 billion. On Ethereum, the attackers used operational wallets funded through Tornado Cash to submit valid signature authorizations, allowing Binance's hot wallet to execute the code deployed by the attackers and sweep the assets.

The article also stated that the attackers transferred $500 million in stablecoins to a wallet for exchange, converting $325 million in stablecoins to $285 million in ETH within nearly 20 minutes, and then transferred the remaining $175 million in stablecoins to a transit wallet. Related freezes began at 5:14 PM Eastern Time, and as of the publication of the article, approximately $2.8 billion had been frozen. Investigators also observed that multiple addresses first received exactly 1 TRX, then received and transferred out other funds, believing this repetitive sequence indicated a programmatic process in the fund transfers. The investigation is ongoing.