- Chainalysis links the $6.4 billion Binance hack to North Korea’s TraderTraitor group.
- Stablecoin issuers and industry partners have frozen about $2.8 billion of the stolen funds.
- Attackers appear to use automation to cycle funds through thousands of addresses.
Chainalysis says its investigators have observed previously unseen laundering patterns while tracing funds stolen in the $6.4 billion Binance hack.
The firm blames North Korean group TraderTraitor for the October 29 attack, the largest theft in crypto history. About $2.8 billion of the stolen funds has been frozen so far.
Chainalysis Links $6.4B Binance Hack to North Korean TraderTraitor Group
Funds started leaving Binance hot wallets across multiple blockchains around 4:20 p.m. ET on October 29. On Ethereum, the attacker used a wallet funded through Tornado Cash to submit valid signed authorizations.
Those approvals allowed a Binance hot wallet to run attacker-deployed code, which then swept its assets into attacker-controlled addresses. The strongest link to TraderTraitor came when Chainalysis watched stolen Binance funds commingle in real time with proceeds from last month’s Bitget exploit, which had been attributed to North Korean actors.
On-chain investigator ZachXBT flagged the same overlap. He said funds from the Binance hack and the $388 million Bitget breach arrived via THORChain at a single address.
MistTrack separately traced stolen TRX through Bitget Wallet Swap Bridge to an address previously used by the Phemex hacker.
Follow us on X for real-time crypto updates.
How Investigators Traced and Froze $2.8B in Stolen Crypto
The attacker held billions in stablecoins such as USDT and USDC, which issuers can freeze. To stay ahead of blacklists, the exploiter moved $500 million in stablecoins into a swap wallet.
Over roughly 20 minutes, that wallet converted $325 million in stablecoins into $285 million in ETH. Ten minutes later, the remaining $175 million went to stopover wallets.
The response came faster than the attacker likely expected. Freezes began at 5:14 p.m. ET, under an hour after the first outflows. Chainalysis, law enforcement, and stablecoin issuers worked in parallel, and around $2.8 billion tied to the Binance hack has been frozen so far.
Binance Hack Reveals New Automated Laundering Techniques
Thousands of transactions in a short window point to automated tooling. The attackers aren’t just pushing funds onward. They keep cycling them among addresses and often send money back to wallets used earlier in the chain.
Many of these addresses follow the same sequence. Each receives exactly 1 TRX, takes in more funds, then forwards them elsewhere. Chainalysis says this repeated pattern suggests a programmatic process built to obscure the trail.
The investigation is ongoing, and Chainalysis expects the stolen funds to keep moving in the coming days.
Chainalysis added that exchanges remain attractive targets for hackers wherever they operate, and urged every platform to stay ready to respond quickly.
Subscribe to our YouTube channel for the latest crypto news.
Related: Elon Musk Reacts to $6.3B Binance Breach With “Everyday Is Zeroday”
Disclaimer: The information presented in this article is for informational and educational purposes only. The article does not constitute financial advice or advice of any kind. Coin Edition is not responsible for any losses incurred as a result of the utilization of content, products, or services mentioned. Readers are advised to exercise caution before taking any action related to the company.
