The $6.3 billion Binance hack has taken a new and increasingly unusual turn, as blockchain investigators track what appears to be a highly automated effort to move and obscure the stolen cryptocurrency.
Chainalysis says its investigators have identified “never-seen-before laundering patterns” in the movement of funds stolen from Binance. Thousands of transactions have been executed within short periods, with the attackers repeatedly circulating funds between wallets instead of simply moving the cryptocurrency along a straightforward trail.
The finding could prove more important than the sheer size of the theft. While blockchain transactions are publicly visible, the attackers appear to be using the transparency of the network against investigators by creating an increasingly complicated web of transactions.
A laundering pattern Chainalysis has not seen before
Traditional cryptocurrency laundering often involves moving stolen assets through a series of wallets, decentralized exchanges, bridges, mixers or other services before attempting to convert them into usable money.
The Binance attackers are taking a different approach, according to Chainalysis. Rather than simply sending funds from Wallet A to Wallet B and then onward, they repeatedly circulate funds between addresses and sometimes send assets back toward wallets that appeared earlier in the transaction sequence.
That repetition is one of the most important clues.
Chainalysis says the speed and recurring structure of the transfers suggest that the process is being automated. In other words, the attackers appear to have created a system capable of repeatedly redistributing stolen funds without manually directing every transaction.
This matters because automation can dramatically increase the amount of activity investigators have to analyze.
Instead of following a relatively simple chain of transfers, blockchain investigators are confronted with thousands of movements occurring across multiple addresses and potentially multiple blockchains.
The attackers are creating noise around the money trail
The unusual wallet behavior appears designed to make the stolen funds harder to distinguish from the surrounding flow of cryptocurrency.
When funds repeatedly move between addresses, return to previously used wallets and then move again, the resulting transaction graph becomes considerably more complicated. Investigators can still see the transactions, but identifying the ultimate destination and separating meaningful movements from deliberate obfuscation becomes more difficult.
Chainalysis says many of the addresses involved followed recurring patterns, including addresses that received exactly 1 TRX before receiving larger amounts and forwarding funds elsewhere. The company says this repeated sequence is consistent with a programmatic process for moving and redistributing the stolen assets.
The significance is not that the blockchain has become invisible.
It has not.
The significance is that the attackers appear to be generating enormous amounts of transaction activity specifically to make the investigation more difficult.
Speed has become part of the attack
The laundering operation is also a race against cryptocurrency companies capable of freezing certain assets.
A large portion of the stolen cryptocurrency consisted of stablecoins such as USDT and USDC. Unlike Bitcoin or Ether, these tokens are issued by companies that can, under certain circumstances, freeze assets associated with identified addresses.
That created a major incentive for the attackers to move quickly.
Chainalysis says the attackers moved approximately $500 million in stablecoins into a wallet specifically used to swap the freezeable assets into cryptocurrencies that could not be frozen by a centralized issuer. Over roughly 20 minutes, about $325 million of stablecoins was converted into approximately $285 million worth of ETH.
The attackers were therefore facing two competing clocks.
They needed to move the stolen funds quickly enough to avoid blacklists and freezes, while also making the transaction trail complicated enough to slow down investigators.
Nearly $3 billion has already been frozen
The strategy has not worked perfectly.
Chainalysis reported that approximately $2.8 billion connected to the Binance theft had been frozen by October 30, while Binance separately said roughly $3 billion had been frozen.
Elliptic independently verified approximately $2.84 billion in frozen funds, representing about 44% of its estimated $6.43 billion theft. Most of the frozen assets were USDT and USDC.
That response demonstrates one of the unusual characteristics of cryptocurrency.
The blockchain allows investigators to see where stolen assets are moving, while stablecoin issuers can sometimes intervene and prevent those assets from being transferred.
The attackers appear to understand that vulnerability and are attempting to move funds into assets without an issuer-controlled freeze mechanism.
Why ETH became a major target
Ether has become particularly important in the laundering process because there is no central Ethereum company capable of freezing ETH in the same way that Tether can freeze USDT.
Elliptic says the attackers converted approximately $786 million in stablecoins into ETH and TRX before freezes could take effect. It identified one transaction involving approximately $434 million in USDT that was exchanged for 160,451 ETH.
The attackers appear to have been willing to accept significant losses to complete those transactions quickly.
Elliptic estimates that some of the swaps involved losses of between 12% and 26% compared with market prices. That suggests the priority was not maximizing the value of the stolen assets, but getting them into forms that were harder to freeze.
The attackers have not simply sent everything through mixers
Another unusual feature of the operation is what has not happened.
Elliptic reported that almost none of the stolen funds had initially reached major cross-chain bridges, mixers or exchanges. The company identified only about $1.9 million in TRX that had gone through THORChain at the time of its October 30 assessment.
That is significant because cryptocurrency laundering operations frequently rely on services designed to make the origin of funds more difficult to establish.
Instead, the Binance attackers have so far relied heavily on rapid wallet movements, asset conversions and repeated redistribution.
That could change.
Elliptic expects the stolen assets to move through additional wallets, bridges, mixers and exchanges as the laundering operation develops.
The blockchain is still giving investigators an advantage
Despite the sophistication of the operation, the attackers have not made the stolen cryptocurrency invisible.
Every transaction on the affected public blockchains creates another piece of evidence. Blockchain intelligence companies can follow those transactions and identify relationships between wallets even when the attackers deliberately create complicated paths.
That is one reason the speed of the operation matters.
The longer investigators can identify and attribute addresses, the greater the opportunity for exchanges, stablecoin issuers and other cryptocurrency companies to block or freeze assets when they encounter them.
The attackers are therefore not operating in a system without surveillance.
They are operating in a system where both sides can see the battlefield.
The investigation is also revealing links to another major hack
Chainalysis says it observed cryptocurrency stolen from Binance becoming commingled with funds from September's Bitget exploit. The earlier theft had been attributed to North Korean actors, and Chainalysis says the overlap has strengthened its assessment that North Korea was responsible for the Binance attack.
Chainalysis currently says it has a high degree of confidence in the North Korea attribution.
However, for reporting purposes, the attribution should still be described as an assessment by blockchain investigators rather than presented as a court-established fact. Elliptic has likewise assessed that North Korea-linked actors are likely responsible.
Binance's security investigation continues
The laundering activity is only one part of the larger Binance investigation.
Binance has said its initial investigation pointed to a compromised DevOps engineer's laptop and unauthorized access to systems involved in transaction signing. Elliptic's analysis indicates that the attackers may have exploited Ethereum's EIP-7702 functionality to delegate control of a Binance hot wallet to attacker-controlled software.
Binance has also said the attackers used a “self-destruct mechanism” to destroy tools and traces during the intrusion.
The exchange has not yet released its complete technical post-mortem, meaning some details of the original intrusion could change as the investigation develops.
What makes the Binance laundering strategy different
The most important development is not simply that billions of dollars were stolen.
It is the way the attackers are now attempting to manage those billions.
Chainalysis says the repeated circulation of funds, the speed of the transactions and the recurring wallet sequences point toward an automated laundering system unlike patterns its investigators have previously observed.
That could represent an important evolution in cryptocurrency crime.
Instead of relying primarily on a handful of established laundering services, attackers can potentially use software to generate thousands of transactions, constantly redistribute funds and deliberately create confusion around the original trail.
The result is not anonymity.
It is complexity at scale.
The stolen Binance funds remain traceable
For investigators, that distinction is crucial.
The Binance attackers have not erased the blockchain record, and they have not made the stolen cryptocurrency impossible to track. They have instead created a much larger and more complicated analytical problem.
That means the race is now between automated laundering and automated blockchain analysis.
If investigators can identify the attacker's wallets faster than the stolen funds can reach services where they can be exchanged for conventional currency, more of the money may still be recoverable.
But if the attackers successfully move the remaining assets through enough layers, the investigation could become substantially harder.
For now, Chainalysis is continuing to follow the funds.
And its most important finding so far is that the Binance hackers appear to be doing something investigators have not previously seen at this scale: using rapid, automated and repetitive wallet movements to turn the blockchain's transparency into a source of investigative complexity.