Chainalysis says it spotted automated laundering after a Binance theft it estimates at $6.4 billion, calling it the largest crypto theft on record. On Oct. 30, investigators said the stolen funds moved through thousands of transfers in a short window—a pattern they say points to software doing the work rather than people clicking through each transaction. Details are still coming together, and some figures may shift as investigators compare notes.
Repeated Transfers and Small Fee Payments
Investigators tracked repeated transfers among addresses, including funds returning to wallets used earlier in the sequence. Many addresses first received exactly 1 TRX, Tron’s native token for transaction fees, before taking more funds and forwarding assets elsewhere. Chainalysis said the repeated sequence suggests a programmatic process for moving and redistributing the stolen funds—the same steps appearing to run again and again across many wallets.
Breach Details and North Korea Link
Binance co-CEO Richard Teng disclosed more breach points and bypassed approval controls, and described a self-destruct mechanism that destroyed tools and traces. Chainalysis traced outflows to about 4:20 p.m. Eastern on Oct. 29 and identified an Ethereum wallet funded through Tornado Cash, a mixer that hides links between deposits and withdrawals. That wallet submitted valid signed authorizations—cryptographically signed permissions—which let a Binance hot wallet run attacker-deployed software and move assets into addresses controlled by the attacker.
Early laundering patterns pointed to Tradertraitor, a North Korean cybercrime group. Chainalysis later saw stolen Binance assets mix with proceeds from September’s Bitget theft, already tied to North Korean actors, strengthening its attribution to Tradertraitor. Separately, TRM Labs attributed the Binance attack to Tradertraitor with high confidence, citing onchain and offchain intelligence.
Stablecoin Swaps and Freezes
Freezing funds takes time. Chainalysis said the attacker tried to stay ahead of that process by moving $500 million of stablecoins into a wallet meant to swap freezable assets for non-freezable ones. Stablecoin freeze and blacklist controls can stop designated addresses from transferring affected tokens, while native ether has no equivalent issuer-controlled mechanism. Over nearly 20 minutes, the wallet exchanged $325 million in stablecoins for about $285 million in ether, then moved the remaining $175 million to intermediary wallets 10 minutes later.
Freezes began by 5:14 p.m. Eastern on Oct. 29. Chainalysis reported about $2.8 billion frozen in its Oct. 30 account, while Binance put the total at roughly $3 billion that day. The exchange said it had reserved more than $6.34 billion in company funds to cover the incident, excluding frozen assets, with $5 billion already held in affected tokens and purchases through market and over-the-counter channels underway to match the remaining assets. The reserve figure is the part to watch, since it shows how much the exchange expects to absorb directly.
