Chainalysis identified suspected automated laundering patterns following a Binance theft estimated at $6.4 billion, which the firm called the largest crypto theft on record. The investigation revealed what the company described as previously unseen laundering tactics deployed by attackers circulating the stolen assets.
Automated Transaction Sequences
Thousands of transfers in a short period suggested automation designed to obscure the fund trail. Investigators tracked repeated transfers among addresses, with many wallets first receiving exactly 1 TRX, Tron's native token used to pay transaction fees, before accepting additional funds and forwarding assets elsewhere. Chainalysis stated that the repeated sequence suggested a programmatic process for moving and redistributing stolen funds.
North Korean Attribution
Chainalysis traced outflows to approximately 4:20 p.m. Eastern time on October 29 and identified an Ethereum wallet funded through Tornado Cash, a crypto mixer that obscures links between deposits and withdrawals. The wallet submitted valid cryptographically signed permissions that enabled attackers to deploy software and transfer assets into attacker-controlled addresses.
Laundering patterns initially suggested involvement by Tradertraitor, a North Korean cybercrime group. Chainalysis strengthened this attribution after observing stolen Binance assets mixing with proceeds from a September Bitget theft previously linked to North Korean actors. Separately, TRM Labs attributed the Binance attack to Tradertraitor with high confidence, citing onchain and offchain intelligence.
Stablecoin Conversions
Attackers moved $500 million in stablecoins into a wallet designed to swap freezable assets for non-freezable ones, as stablecoins can be subject to issuer-controlled freeze and blacklist controls while native ether has no equivalent mechanism. Over nearly 20 minutes, the wallet exchanged $325 million in stablecoins for approximately $285 million in ether, then moved the remaining $175 million to intermediary wallets 10 minutes later.
Freezes began by 5:14 p.m. Eastern time on October 29. Chainalysis reported approximately $2.8 billion in frozen assets as of October 30, with Binance putting the total at approximately $3 billion. The exchange reserved more than $6.34 billion in company funds to cover the incident, excluding frozen assets, with $5 billion already held in affected tokens.
