Chainalysis reported suspected automated laundering on Oct. 30 after a Binance theft it estimated at $6.4 billion. It said thousands of rapid, repeated transfers suggested a programmatic effort to move the stolen assets; the pattern does not establish who carried it out. Chainalysis said stolen Binance assets mixed with proceeds from September’s Bitget theft, strengthening its attribution of the hack to the North Korean group Tradertraitor. TRM Labs separately attributed the attack to that group with high confidence.
Chainalysis said an attacker moved $500 million in stablecoins to a wallet used to swap assets before they could be frozen. Over nearly 20 minutes, the wallet exchanged $325 million in stablecoins for about $285 million in ether, then moved the remaining $175 million to intermediary wallets. Chainalysis reported about $2.8 billion frozen in its Oct. 30 account, while Binance put the total at approximately $3 billion that day. Binance said it had reserved more than $6.34 billion in company funds to cover the incident, excluding frozen assets.
