Chainalysis investigators assess that the $6.4 billion Binance hack — the largest cryptocurrency theft on record and among the biggest financial crimes in history — was carried out by TraderTraitor, a North Korean cybercrime group. TraderTraitor has repeatedly attacked cryptocurrency exchanges, DeFi protocols and investors to generate revenue for the regime.
The assessment rests on on-chain activity observed in the hours after the hack.
Initial breach and attacker's race against the clock
Funds started flowing out of Binance hot wallets across multiple blockchains at approximately 4:20 p.m. Eastern Time on October 29. On Ethereum, the attacker operated from a wallet funded via Tornado Cash and submitted valid signed authorizations that permitted a Binance hot wallet to execute attacker-deployed code. The attacker then called that wallet to sweep its holdings into addresses under attacker control, while other affected Binance wallets appeared to transfer funds through ordinary signed transactions. The unauthorized transfers across affected blockchains totaled approximately $6.4 billion USD.
The attacker now faced a time constraint. While billions of dollars in unfreezable cryptocurrencies such as Bitcoin and Ethereum were under their control, billions more sat in stablecoins like USDT and USDC that issuers can freeze. It was inevitable that stablecoin issuers would freeze those holdings — in coordination with law enforcement and industry partners including Chainalysis.
Because freezing takes time, the attacker tried to stay ahead by rapidly moving $500 million of stablecoins into a wallet tasked with swapping freezable assets for non-freezable ones. Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH. Ten minutes after that, the exploiter sent the remaining $175 million in stablecoins to stopover wallets. By 5:14 p.m. Eastern Time on October 29, however, freezes began.
Across multiple blockchains, Chainalysis investigators, law enforcement, stablecoin issuers and other industry participants raced to freeze stolen funds before the attacker could convert them into assets beyond issuers' reach. Much of this effort unfolded independently, with organizations acting in parallel. Chainalysis proactively shared investigative leads with industry partners to help identify and freeze stolen funds. Approximately $2.8 billion of the stolen funds have been frozen so far.
Direct on-chain link to TraderTraitor through Bitget exploit
Several laundering patterns initially pointed to TraderTraitor as responsible for the Binance theft. The strongest evidence surfaced when Chainalysis investigators observed, in real time, stolen Binance funds commingling with funds stolen in last month's Bitget exploit, which had been attributed to North Korean actors. That direct on-chain link strengthened the assessment that TraderTraitor carried out the Binance hack, and Chainalysis announced the link on October 30, 12:30 a.m. Eastern Time.
Automated laundering obscures fund trails
As Chainalysis investigators continue tracing funds stolen from Binance, they are observing laundering patterns not seen before. Thousands of transactions in a short period suggest the attackers are using automation to obscure the trail of funds. Rather than simply forwarding funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses. This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.
Ongoing investigation and industry response
The investigation remains ongoing and Chainalysis expects the stolen funds to continue moving in the coming days. Chainalysis is committed to supporting Binance and the wider industry as investigators trace the stolen funds, disrupt further laundering and work to mitigate additional losses.
Chainalysis customers can use the firm's solutions to identify exposure to addresses linked to this incident. Chainalysis will continue to monitor the flow of funds and update labels as new information emerges.
Source: www.chainalysis.com