Analysis: Unprecedented Automated Money-Laundering Pattern Seen in Binance Stolen Funds

October 30: Blockchain analytics firm Chainalysis posted on X that its investigators observed an unprecedented money-laundering pattern in the stolen Binance funds: the attackers initiated thousands of transactions in a short period, apparently using automated means to obscure the flow of funds; the funds were not simply moved downstream but repeatedly cycled among multiple addresses and often flowed back to addresses that had already been used. Chainalysis added in a blog post that many addresses show the same pattern, first receiving exactly 1 TRX and then receiving more funds before transferring them out. In addition, the attackers once moved $500 million in stablecoins into a swap wallet, which within about 20 minutes swapped $325 million of stablecoins for $285 million worth of ETH, while the remaining $175 million was transferred to a relay wallet about 10 minutes later. Chainalysis said that as of the blog's publication, about $2.8 billion of the stolen assets had been frozen, and it assessed with relatively high confidence that the attack was carried out by the North Korean hacking group TraderTraitor.