Binance Hackers Use Automated Transactions to Launder $6.4B Stolen Crypto

Hackers behind the $6.4 billion Binance exploit are using automated transactions to move stolen funds between thousands of crypto wallets, repeatedly circulating assets to make them harder to trace, according to blockchain analytics firm Chainalysis.

Investigators have identified thousands of transactions in a short period, with wallets repeatedly sending funds to addresses involved earlier in the laundering process.

Some addresses follow a consistent pattern of first receiving exactly 1 TRX (CRYPTO: $TRX) before taking in larger amounts and forwarding the funds elsewhere, suggesting the attackers are using automated scripts to distribute the stolen assets.

Chainalysis said the laundering activity also helped link the attack to TraderTraitor, a North Korean cybercrime group. Investigators found that funds stolen from Binance were mixed with assets taken in last month’s Bitget exploit, which had also been attributed to North Korean hackers.

The Binance attack began around 4:20 p.m. ET on Thursday, when unauthorized transfers drained hot wallets across several blockchains. The attackers moved roughly $500 million in stablecoins, converting $325 million into approximately $285 million worth of Ether (CRYPTO: $ETH) in an attempt to avoid freezes by stablecoin issuers.

The effort was only partly successful. Tether (CRYPTO: $USDT) and other industry participants began freezing funds around 5:14 p.m. ET, following coordination between investigators, law enforcement, and crypto companies. Approximately $2.8 billion of the stolen assets have been frozen.

“The sheer scale of this hack makes it look like a one-off, but it isn't. AI is helping attackers find weaknesses faster than companies can fix them, and attacks like this are becoming more common,” Stefan Deiss, CEO of The Hashgraph Group, told CryptoProwl.

“The fact that Binance may have the balance sheet to absorb the damage is encouraging, but I wouldn't confuse financial strength with operational security,” Ryan Kirkley, Co-founder and CEO of Global Settlement Network (GSN), said.