Binance Hacker Moves Millions of Dollars Again: The Like Has Never Been Seen Before

Researchers tracking cryptocurrencies stolen in the multi-billion dollar attack on Binance have detected new activity in wallets associated with the attacker. OnchainLens reported today that approximately 120 million TRX, worth about $38.78 million, were transferred and subsequently distributed to different addresses.

The Tronscan record provided in the post confirms that the 120 million TRX transaction was successfully completed today at 04:01 Turkish time. The funds were sent from an address starting with “TL2F4G…” to a wallet starting with “TRBdWq…”.

According to OnchainLens, what’s striking is not only the size of the transfer but also the route the money took. Funds were repeatedly split between addresses linked to the attacker through automated transactions, some amounts were sent back to previously used wallets, and then distributed to new addresses. The research account assessed these actions as a money laundering operation designed to make it difficult to track the funds.

The account noted that cryptocurrency mixers were not yet being used extensively in the observed transactions. Thus, the prominent method in today’s transactions was transfers going back and forth between numerous wallets.

Bitquery, after examining the attacker’s previous movements, identified a similar distribution chain on the Tron network. The company’s October 30th analysis noted that a total of 11.4 million TRX was withdrawn from a single wallet in over 30 transactions. Two observed routes showed the TRX being routed through new addresses, converted to USDT via SunSwap, and then sent to two unidentified old wallets.

On the Ethereum side, funds were also gathered in different addresses. According to the same analysis, 17,260 ETH was moved from the main recipient wallet to a new address on October 30th. A total of 14,540 ETH from the four wallets where the stolen tokens were sold was consolidated into another address, while 7,647 ETH was transferred from the second recipient wallet.

On the Bitcoin side, it was determined that approximately 18,270 BTC that was stolen was distributed among 19 addresses.

Converting the funds into different cryptocurrencies was also a significant part of the operation. Bitquery determined that approximately $729 million worth of stolen USDT was converted into ETH and TRX before the freezing procedures could be completed.

These hasty transactions proved costly for the attacker. According to the company’s investigation, which also examined the trades, there was a loss of approximately $119 million in value compared to market prices. Approximately $71.5 million of this was due to paying above-market prices for ETH purchases, $24.8 million from selling the stolen tokens at a low price, and $22.4 million from TRX purchases.

An error also came to light during the transfers. Lookonchain reported yesterday that the attacker accidentally sent approximately $3.32 million worth of altcoins to the contract address of the NEWT token. The investigative account stated that these assets are therefore irretrievable.

Binance, in its latest official statement, announced that approximately $3 billion worth of assets have been frozen on-chain.