Binance Hack Funds Split Across 12,000 Wallets in Four Days, Signaling Automated Laundering

Crypto assets stolen from Binance were scattered across multiple blockchains through tens of thousands of transactions, blockchain analysis showed.

According to Elliptic, the blockchain analytics firm cited by Bitcoin.com on November 2, the $6.43 billion in crypto stolen from Binance on November 29 was moved in less than four days to about 12,000 wallets across 11 blockchains. More than 40,000 transactions were identified in the process.

Elliptic found signs that the transfers were program-driven, including fixed intervals between transactions, repeated transfer amounts and automatic retries after failed transactions. It said there was no evidence that artificial intelligence directly made or controlled the transfer decisions.

Chainalysis had earlier detected repetitive fund-transfer patterns immediately after the hack. In some wallets, 1 Tron, or TRX, was first sent to cover transaction fees before large amounts of assets arrived. Funds were then repeatedly moved from those wallets to other addresses, raising the possibility of automated money laundering.

Hackers also used decentralized finance lending vaults and Bitcoin mixing transactions to make the funds harder to trace. Elliptic said 28 Bitcoin worth about $2.2 million passed through 18 CoinJoin transactions between November 1 and November 2. CoinJoin combines transactions from multiple users, making it harder to trace the path of individual funds.

The FBI identified the North Korea-linked group TraderTraitor as being behind the hack on October 31. The bureau is tracking the flow of funds in cooperation with the U.S. Secret Service and the Internal Revenue Service Criminal Investigation division, and asked exchanges and DeFi service operators to block transactions involving the related wallet addresses.

Some of the stolen assets have already been frozen. As of November 2, Elliptic had tracked about $2.85 billion that had been frozen. The hackers were holding about $1.43 billion in Bitcoin across 40 wallets and about $1.37 billion in Ether across 857 wallets. About $16 million was moved to an address that previously held funds from the Bitget hack.

Elliptic estimated that about $3.24 billion remained in wallets linked to the hack at the time of its analysis. It also said the hackers may try to cash out the assets over the coming months through over-the-counter, or OTC, brokers.