Hackers behind Binance’s $6.3 billion breach are using previously unseen laundering tactics while rapidly converting stolen assets into other cryptocurrencies.
On Oct. 30, blockchain analytics firm Chainalysis said that investigators identified thousands of transactions executed within short periods, suggesting the attackers used automation to obscure the movement of stolen funds.
The discovery comes as Elliptic reported that the hackers had converted approximately $786 million in stolen stablecoins into Ethereum and Tron before asset freezes took effect, sometimes accepting significant losses to complete transactions quickly.
Binance hackers use automated wallet loops and aggressive token swaps
According to Chainalysis, the attackers have adopted unusual transaction patterns that repeatedly circulate stolen assets among interconnected cryptocurrency addresses.
The funds sometimes return to wallets involved earlier in the laundering sequence, creating complicated transaction histories.
The firm described these movements as “laundering patterns we have not seen before,” pointing to their speed and repetitive nature as evidence of suspected automation.
Investigators also identified a distinctive pattern on the Tron blockchain, where numerous wallets received exactly 1 TRX before accepting additional funds and forwarding them to other addresses.
The repeated sequence suggests that the attackers are using programmed instructions to coordinate movements across numerous wallets.
The approach could complicate blockchain investigations by creating thousands of overlapping transfers that analysts must review to trace the destination of stolen assets.
Binance hacker sold assets at a steep discount
Meanwhile, Elliptic’s investigation revealed that the attackers have been aggressively exchanging stolen cryptocurrencies through decentralized trading platforms.
On Ethereum, the hackers converted approximately 434 million USDT into 160,451 ETH through Uniswap, 1inch, and market makers’ request-for-quote systems.
The transactions were executed at prices 12% to 26% worse than prevailing market rates, suggesting the attackers prioritized rapid conversion over preserving the full value of the stolen assets.
The hackers also exchanged approximately 234 million USDT for 638 million TRX through SunSwap, while another $48 million in Ripple’s RLUSD stablecoin was sold before further restrictions were imposed.
Elliptic identified additional sales involving approximately 150 other stolen tokens, which the attackers converted into ETH through decentralized exchanges.
The conversions let the attackers consolidate assets into native cryptocurrencies such as ETH and TRX, which token issuers cannot directly freeze.
However, a substantial portion of the stolen Bitcoin has followed a different route.
Elliptic found that the attackers divided 18,270 BTC across 19 addresses through a series of smaller transfers, with most addresses holding approximately 1,000 BTC each.
As of the firm’s Oct. 30 assessment, none of those Bitcoin holdings had reached an identified exchange or other service.
Elliptic expects the attackers to eventually route more stolen assets through additional wallets, cross-chain bridges, mixers, and trading services before attempting to cash them out through over-the-counter brokers and cryptocurrency exchanges.
