- Trending
- Comments
- Latest
Hackers who stole an estimated $6.3 billion from Binance on October 29, 2026 raced to swap freezable stablecoins for ETH within minutes, Chainalysis said on October 30, 2026.
The firm links the attack to North Korea’s TraderTraitor group and says thousands of automated transfers, including repeated 1 TRX deposits to prepare wallets for Tron network fees, were used to move the funds while about $3 billion was frozen.
Blockchain analytics firm Chainalysis reported on October 30, 2026, that attackers behind the Binance security breach were using previously unidentified methods to move stolen cryptocurrency across multiple wallet addresses.
According to the investigation, the Binance hackers distributed funds through thousands of transactions within a relatively short period.
The repeated movements suggested that the operation was automated rather than manually coordinated, making it more difficult for investigators to follow the movement of assets.
The investigation identified recurring transfers between multiple cryptocurrency addresses, including instances where funds returned to wallets that had already participated in earlier transactions.
Another unusual discovery involved the repeated transfer of exactly 1 TRX into several receiving wallets before larger amounts of cryptocurrency arrived.
Since TRX is used to pay transaction fees on the Tron network, investigators believe these small deposits may have been part of a coordinated process designed to prepare wallets for subsequent transfers.
Chainalysis explained that the repeated activity pointed toward automated fund distribution, indicating that the attackers had developed a structured process for moving assets while attempting to complicate blockchain investigations.
Beyond the unusual transaction patterns, investigators have identified evidence connecting the Binance hackers to TraderTraitor, a North Korean-linked cybercrime group known for targeting cryptocurrency exchanges, blockchain projects and digital asset investors.
Chainalysis initially identified similarities between the laundering activity and methods previously associated with North Korean cybercriminal operations.
However, a stronger connection emerged when investigators discovered that funds stolen from Binance were being mixed with cryptocurrency taken during September’s Bitget security breach.
The earlier Bitget incident had also been attributed to North Korean actors. According to Chainalysis, the movement of funds between wallets associated with both incidents strengthened its assessment that TraderTraitor was responsible for the Binance attack.
The investigation also identified an Ethereum wallet funded through Tornado Cash, a cryptocurrency mixing service designed to make it harder to establish connections between transaction deposits and withdrawals.
That wallet reportedly submitted valid cryptographic authorizations that allowed attacker-deployed software to execute transactions through a Binance hot wallet. The attackers subsequently transferred assets into addresses under their control.
One of the most significant developments in the investigation concerns the attackers’ attempts to convert stablecoins into cryptocurrencies that cannot be frozen by a central issuer.
Stablecoins such as USDT and USDC have mechanisms that allow their issuers to restrict transfers from designated wallet addresses. These controls can help exchanges, investigators and law enforcement agencies prevent stolen funds from circulating further.
However, cryptocurrencies such as Ethereum do not have an equivalent issuer-controlled freezing mechanism.
Chainalysis reported that the attackers moved approximately $500 million in stablecoins into a wallet apparently designated to convert the assets before freezing restrictions could take effect.
Chainalysis says that freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets.
The figures from the investigation show that approximately $325 million in stablecoins was exchanged for around $285 million worth of ETH over nearly 20 minutes.
Another $175 million in stablecoins was subsequently transferred into intermediary wallets approximately 10 minutes later.
According to Chainalysis, freezing operations began at approximately 5:14 p.m. Eastern Time on October 29, shortly after the attackers had initiated their conversion strategy.
By October 30, Chainalysis reported that approximately $2.8 billion in stolen assets had been frozen. Binance separately reported that the amount had reached approximately $3 billion.
The discovery of new laundering methods associated with the Binance hackers raises important questions about security across the broader cryptocurrency ecosystem.
Centralized exchanges remain attractive targets because they manage substantial amounts of digital assets and rely on interconnected systems to process deposits, withdrawals and other transactions.
Although blockchain analytics tools have improved the industry’s ability to monitor suspicious activity, the latest incident shows that attackers continue to develop strategies intended to frustrate investigations.
Binance also disclosed that it had reserved more than $6.34 billion in company funds to cover losses associated with the incident, excluding assets that had already been frozen.
The exchange said approximately $5 billion of that amount was already held in affected tokens, while additional purchases through market and over-the-counter channels were underway.
However, investors should distinguish between the company’s stated financial coverage arrangements and the ongoing recovery of the stolen cryptocurrency. The two processes are related but do not mean that every stolen asset has already been recovered.
The investigation also reinforces the need for investors to assess the security arrangements of cryptocurrency platforms before committing substantial funds.
Exchange reputation, custody practices, withdrawal controls and transparency during security incidents remain important considerations.
The use of automated transfers, intermediary wallets, mixing services and rapid asset conversions demonstrates how quickly attackers can adapt when they expect intervention from exchanges and token issuers.
Chainalysis has indicated that its investigation remains ongoing and that the stolen assets could continue moving through different wallet addresses in the coming days.
Copyright © 2025 - The Bit Gazette.
