Automated Laundering Followed $6.4 Billion Binance Theft

Investigators found an automated laundering pattern involving thousands of transactions after the Binance theft, valued at about $6.4 billion, with about $2.8 billion frozen by the latest update.

The funds did not follow a simple route away from Binance. Funds moved repeatedly among addresses, often returning to wallets that had appeared earlier in the transaction sequence. The high volume of activity over a short period pointed to automated movement.

Unauthorized transfers began leaving Binance hot wallets across multiple blockchains around 4:20 p.m. ET on Oct. 29. Chainalysis attributed the theft to TraderTraitor, a North Korean cybercrime group, and called it one of the largest thefts in cryptocurrency history.

On Ethereum, the attackers used an operations wallet funded through Tornado Cash to submit valid signatures. That allowed Binance hot wallets to run code deployed by the attackers and move assets.

Freezes began at 5:14 p.m. ET on Oct. 29. About $2.8 billion had been frozen by the company’s update, and the investigation is ongoing.