Chainalysis: Binance Hacker Uses DeFi Deposit Receipts to Evade Freeze

On October 31 that, according to Chainalysis monitoring, Binance hackers exploited deposit certificates from a DeFi lending protocol on the Tron network to transfer stablecoin redemption rights, thereby bypassing issuer-imposed freezes. The firm illustrated the process using a $500,000 fund flow linked to the North Korean TraderTraitor group.

Initially, the attacker swapped TRX for stablecoins, deposited them into the lending protocol to acquire deposit certificates, and then transferred these certificates to a new wallet. The new wallet proceeded to redeem the stablecoins, which were then swapped for ETH through a cross-chain bridge. These deposit certificates represent a claim against the assets held in the protocol’s pool, effectively decoupled from the freeze mechanisms applied to the underlying stablecoins.