Chainalysis flags novel laundering patterns in $6.4B Binance hack

What happened

Chainalysis said on Oct. 30 that it had identified never-seen-before laundering patterns connected to a Binance-related theft it estimated at $6.4 billion and called the largest crypto theft on record. Bitcoin.com News and Finbold reported the findings. The analytics firm said the stolen assets moved through thousands of transactions in a short period, a sign that automated tools were being used to obscure the trail.

Investigators tracked repeated transfers among addresses, including movements back to wallets that had appeared earlier in the sequence. Many addresses first received exactly 1 TRX, Tron's native token used to pay transaction fees, before accepting larger amounts and forwarding assets elsewhere. Chainalysis said the repeated sequence pointed to a programmatic process for moving and redistributing the funds.

Chainalysis traced outflows to about 4:20 p.m. Eastern time on Oct. 29 and identified an Ethereum wallet funded through Tornado Cash, a mixer that obscures links between deposits and withdrawals. That wallet submitted valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed software and transfer assets into attacker-controlled addresses. Binance co-CEO Richard Teng disclosed additional breach points and bypassed approval controls, along with a self-destruct mechanism that destroyed tools and traces.

The laundering patterns initially suggested involvement by TraderTraitor, a North Korean cybercrime group. Chainalysis then observed stolen Binance assets mixing with proceeds from September's Bitget theft, which had previously been attributed to North Korean actors, strengthening its attribution. Separately, TRM Labs attributed the Binance attack to TraderTraitor with high confidence, citing onchain and offchain intelligence.

Why it matters

Chainalysis's account shows how quickly attackers tried to outrun efforts to freeze stolen assets. The firm said freezing funds takes time, and the attacker moved $500 million of stablecoins into a wallet whose job was to swap freezable assets for non-freezable ones. Stablecoin freeze and blacklist controls can stop designated addresses from transferring affected tokens, while native ether has no equivalent issuer-controlled mechanism. The race matters for exchanges, stablecoin issuers and investigators trying to secure assets before they are converted or dispersed.

The case also illustrates how attribution can firm up as onchain evidence accumulates. Chainalysis's initial suspicion based on laundering patterns was reinforced when Binance-linked funds mixed with Bitget proceeds, and TRM Labs reached the same conclusion independently. For exchanges and issuers, the episode puts focus on monitoring, freeze procedures and coordination with other platforms.

What the data shows

Over nearly 20 minutes, the conversion wallet exchanged $325 million in stablecoins for approximately $285 million in ether, then moved the remaining $175 million to intermediary wallets 10 minutes later, according to Chainalysis. Freezes began by 5:14 p.m. Eastern time on Oct. 29. Chainalysis reported about $2.8 billion frozen in its Oct. 30 account, while Binance put the total at approximately $3 billion that day. Binance also said it had reserved more than $6.34 billion in company funds to cover the incident, excluding frozen assets; $5 billion of that was already held in affected tokens, and purchases through market and over-the-counter channels were underway to match the remaining assets.

Background

Chainalysis's Oct. 30 investigation was titled "The $6.4 Billion Binance Hack: Tracing the North Korea Link." The Bitget overlap provided additional evidence for the suspected North Korean connection, according to the reports. TRM Labs' high-confidence attribution added a second analytics firm's assessment. Binance has said its monitoring team detected a malicious DAO proposal, warned the unnamed project and coordinated deposit closures with exchanges.

What to watch

Investigators and exchanges are continuing to freeze and recover assets, and Binance said purchases through market and over-the-counter channels were underway to match the remaining assets. The difference between Chainalysis's $2.8 billion frozen figure and Binance's approximately $3 billion figure may become clearer as the response continues. The reports did not say whether all stolen funds have been accounted for or how much may ultimately be recovered.

Questions readers ask