Blockchain analytics firm Elliptic said that crypto assets taken from Binance on Oct. 29 were routed through approximately 12,000 wallets on 11 different blockchains in less than four days. The firm tracked more than 40,000 transactions linked to the theft, which involved $6.43 billion worth of assets.
Automated laundering pattern
Elliptic described the laundering operation as highly complex and clearly automated, noting that a new wallet was used roughly every 25 seconds. The firm identified fixed timing, set amounts and blind retries, indicating conventional software scripts rather than artificial‑intelligence decision‑making.
Cross‑chain activity and mixing
Chainalysis observed repeated transfers between addresses and returns to earlier wallets, with many receiving addresses first obtaining 1 TRX for transaction fees before forwarding larger balances. The attacker also employed lending vaults and protocol contracts to move funds without direct transfers. Bitcoin mixing began on Nov. 1, with about 28 BTC (≈$2.2 million) passing through 18 coinjoins by Nov. 2.
Intervention and remaining funds
The FBI attributed the hack to the North Korean group Tradertraitor and, together with U.S. agencies, urged exchanges and DeFi services to block transactions involving the identified addresses. As of Nov. 2, Elliptic estimated $2.85 billion of the stolen assets were frozen, while roughly $3.24 billion remained in theft‑linked addresses, primarily in ether and bitcoin. The firm expects cash‑out attempts to occur over several months, potentially via over‑the‑counter brokers.
