Blockchain analytics firm Elliptic says the $6.4 billion theft from Binance, linked to a North Korean hacking group, is being laundered at a rapid pace. The firm observed a new wallet being created about every 25 seconds as part of an automated process.
Laundering Mechanics
Elliptic’s analysis details more than 40,000 transactions involving 12,000 wallets on 11 different blockchains within four days. Most of the activity has moved through the Tron network, where roughly 7,700 addresses split the funds before bridging them to Ethereum. Since November 1, additional movements have been recorded on Ethereum, Solana, Near and XRP.
Use of Stablecoins and Freezes
According to Elliptic’s chief scientist Tom Robinson, $3.46 billion of the stolen assets were stablecoins such as USDT and USDC. These tokens can be frozen by their issuers, prompting the attackers to quickly convert them into other assets. On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived; before the freeze, the hackers swapped $434 million USDT for ETH on decentralized exchanges and borrowed 19,762 ETH on Aave against $59.9 million USDT. On Tron, 234 million USDT was swapped for TRX on SunSwap before Tether froze the remainder. Circle froze all $823 million USDC before any swaps occurred.
Frozen and Seized Funds
Elliptic reports that $2.85 billion of the stolen crypto has been frozen or seized, while approximately $786 million of stablecoins were converted before the freezes took effect. The analysis also notes that about 28 BTC ($2.2 million) has been processed through Wasabi-style coinjoins since November 1.
Attribution
Chainalysis attributes the hack to the North Korean cybercrime group TraderTraitor, which is believed to operate under the Lazarus Group, a state-sponsored hacking outfit.
