Hackers behind Binance's $6.3 billion breach are employing previously unseen laundering tactics while rapidly converting stolen assets into other cryptocurrencies, according to investigations by blockchain analytics firms Chainalysis and Elliptic.
Automated Transaction Patterns Obscure Fund Movement
On October 30, Chainalysis identified thousands of transactions executed within short periods, suggesting the attackers used automation to obscure the movement of stolen funds. The attackers have adopted unusual transaction patterns that repeatedly circulate stolen assets among interconnected cryptocurrency addresses, sometimes returning funds to wallets involved earlier in the laundering sequence to create complicated transaction histories.
Chainalysis described these movements as "laundering patterns we have not seen before," citing their speed and repetitive nature as evidence of suspected automation. Investigators identified a distinctive pattern on the Tron blockchain, where numerous wallets received exactly 1 TRX before accepting additional funds and forwarding them to other addresses, suggesting programmed instructions coordinated movements across numerous wallets.
Stablecoins Converted at Significant Losses
Elliptic reported that hackers converted approximately $786 million in stolen stablecoins into Ethereum and Tron before asset freezes took effect. On Ethereum, the attackers converted approximately 434 million USDT into 160,451 ETH through Uniswap, 1inch, and market makers' request-for-quote systems at prices 12% to 26% worse than prevailing market rates.
The hackers also exchanged approximately 234 million USDT for 638 million TRX through SunSwap and sold approximately $48 million in Ripple's RLUSD stablecoin. The steep discounts suggest the attackers prioritized rapid conversion over preserving the full value of stolen assets, allowing them to consolidate holdings into native cryptocurrencies such as ETH and TRX, which token issuers cannot directly freeze.
Bitcoin Holdings Remain Undispersed
A substantial portion of the stolen Bitcoin has followed a different route. Elliptic found that attackers divided 18,270 BTC across 19 addresses through smaller transfers, with most addresses holding approximately 1,000 BTC each. As of October 30, none of those Bitcoin holdings had reached an identified exchange or other service.
Elliptic expects the attackers to eventually route more stolen assets through additional wallets, cross-chain bridges, mixers, and trading services before attempting to cash them out through over-the-counter brokers and cryptocurrency exchanges.
