Chainalysis: Hackers using ‘never-seen-before laundering patterns’
US blockchain analysis firm Chainalysis has spotted that the hackers behind the Binance theft are using “ never-seen-before” patterns to launder the stolen assets and stay ahead of the authorities.
They report that thousands of transactions have taken place in a short period, suggesting the attackers are using automation to obscure the trail of funds.
Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Chainalysis explains:
While billions of dollars in crypto under their control were denominated in unfreezable cryptocurrencies like Bitcoin and Ethereum, billions more were held in stablecoins like USDT and USDC that can be frozen. It was only a matter of time before the issuers of those stablecoins would freeze those funds — in coordination with law enforcement and industry partners such as Chainalysis.
Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets. Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH. Ten minutes later, the exploiter sent the remaining $175 million in stablecoins to stopover wallets, likely trying to move faster than a blacklist or freeze. But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
Key events
The Binance hack shows the perils of accidentally clicking on a rogue link, argues Suzy Pallett, president of international cybersecurity conference Black Hat,
“The Binance incident looks set to become the biggest crypto heist in history, and what’s striking is how familiar this playbook is. Billions can vanish because one person clicked the wrong thing, and with cyberattacks like these, it all starts by compromising a person, not a platform.
“The question now is not only who executed this attack, but how money like this gets laundered and cashed out once it’s been stolen. It’s a complicated process, and if we really want to understand how hackers execute attacks like these, we need to be working closely with the people who hunt these perpetrators down.
“Journalists, law enforcement, and the cybersecurity industry have a wealth of intelligence to offer when it comes to large-scale financial attacks, and with international collaboration between these communities, we can collectively work faster and more efficiently to protect against these common exploits.”
[as covered earlier, the hack appears to have been perpetrated through a “compromised DevOps engineer’s laptop”, though Binance insist it was a more complex attack process than just a single click…]
Alexander Shirtcliff, head of commercial disputes and class actions at legal firm Edwin Coe, suggests Binance customers might need to consider legal action to recover losses:
Although Binance insists it has “publicly committed to cover losses”, Edwin Coe suggests “blandishments” from the board of Binance are largely for press consumption.
Shirtcliff says:
Taking the current standard user terms at face value, they contain limits to Binance’s liability to customers and I see no commitment on using the Secure Asset Fund. Neither will it be quick. How Binance decides to distribute the funds, to whom and when, the value of Bitcoin being volatile, will create a constellation of additional legal issues for the exchange which it will take time to work through.
“It is very unlikely that voluntarily distributed reserves will be enough and customers will have to seek to compel Binance to make them whole. That will mean litigation. A collective action is sometimes the only way for some in cases like this to seek recourse, pooling resources to make litigation viable for many individual victims.”
Shirtcliff also suggests there could be litigation concerning who owns the assets which have been frozen since the hack was discovered.
Binance promises to ‘weather this storm’ as asset recovery begins
Binance has announced that it has “begun recovering affected assets for users” lost in the heist.
It says it is working with law enforcement, issuers, blockchain intelligence firms and industry partners to trace, freeze and recover additional funds.
Binance explains that it will use its own reserves of crypto assets to cover losses where possible, and buy other assets in the market:
Binance has already reserved over $6.34B of company funds to cover this incident. $5B of these funds are already held in the exact token assets that were impacted. We are completing the purchase of the remaining amount by buying token assets through market channels and OTC channels. We are doing this to match the format of the remaining token assets and address any asset shortfalls. This step can take longer because some tokens may have low liquidity and OTC settlement also takes time. We will share more progress as soon as we can.
These figures do not include frozen or protected assets, which remain subject to ongoing recovery and verification. Currently, $3bn has been frozen, with thanks to our industry partners. We are working with partners and law enforcement to recover the frozen assets.We will continue to use company resources to cover confirmed shortfall and will provide further verified updates as recovery efforts progress. Ultimately, all user funds will be verified publicly through our Proof of Reserves.
We will weather this storm. Thank you for the support.
Chainalysis: Hackers using ‘never-seen-before laundering patterns’
US blockchain analysis firm Chainalysis has spotted that the hackers behind the Binance theft are using “ never-seen-before” patterns to launder the stolen assets and stay ahead of the authorities.
They report that thousands of transactions have taken place in a short period, suggesting the attackers are using automation to obscure the trail of funds.
Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Chainalysis explains:
While billions of dollars in crypto under their control were denominated in unfreezable cryptocurrencies like Bitcoin and Ethereum, billions more were held in stablecoins like USDT and USDC that can be frozen. It was only a matter of time before the issuers of those stablecoins would freeze those funds — in coordination with law enforcement and industry partners such as Chainalysis.
Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets. Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH. Ten minutes later, the exploiter sent the remaining $175 million in stablecoins to stopover wallets, likely trying to move faster than a blacklist or freeze. But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
The Binance theft is a reminder that cryptocurrencies are not covered by the UK’s bank deposit protection scheme (which compensates customers if a bank fails).
James Broomhall, senior associate at Grosvenor Law, says victims of cybertheft often have to turn to the courts:
“Unlike money held in a UK bank account, which may be protected by the Financial Services Compensation Scheme (FSCS) up to £120,000 per eligible depositor, cryptoassets generally do not benefit from any equivalent compensation regime.”
“As a result, victims of major crypto thefts are often forced to pursue urgent tracing and recovery action through the courts, including Norwich Pharmacal applications to compel exchanges and other third parties to disclose information identifying fraudsters and tracing the movement of stolen assets.”
UK financial watchdogs monitoring fallout from Binance heist
Kalyeena Makortoff
The UK’s financial watchdogs are now monitoring for any potential fallout from the Binance heist.
A spokesperson for Britain’s Financial Conduct Authority (FCA) said:
“While Binance wasn’t registered with the FCA to provide crypto services in UK, we’re aware of the reported incident and engaging with them to understand the impact.”
While crypto firms are not regulated in the UK, the Bank of England and FCA will be keeping an eye on any banks, insurers or fintechs that are exposed to Binance, and how that could ultimately hurt the UK’s wider financial system.
The Bank of England is monitoring the Binance hack, according to a source familiar with the matter. However, it is understood there is no active concerns. The Bank of England declined to comment.
Justas Pukys, senior product manager at Surfshark, a cybersecurity company), reckons Binance customres shuold watch out for a potential second wave of scams targeting them.
That would involce criminals impersonating Binance representatives through fake security alerts and requests to transfer funds into “safe” wallets.
Pukys explains:
“The reported $6.3 billion Binance hack is alarming, but cryptocurrency holders should also be on high alert for a potential second wave of scams. Criminals could exploit the panic surrounding the incident to trick people into handing over their savings.
“Scammers may pose as Binance representatives, sending convincing emails or text messages warning that accounts are at risk or offering to help recover stolen funds. Some could even claim to be from Binance’s security team, urging users to transfer their cryptocurrency to a supposedly ‘safe’ wallet. In reality, following these instructions could mean handing your money directly to criminals.
Reminder: Binance’s Richard Teng reassured customers this morning that “your money is safe, and we’re covering every loss.”
Binance’s breach may show the “industrialisation of state-sponsored crime” is underwya, argues Keystone Law’s fraud & financial crime partner Syed Rahman:
“The more important number in this hack may not be $6.3 billion. It may well be 20 minutes. The attacks had the advantage of preparation and coordination. Everyone responding had to establish what happened in real time. The challenge for the industry is where collaborative efforts in recovering those losses can ever match the speed of a pre-planned attack without sacrificing safeguards that make financial intervention legitimate.
“In essence, the real concern is not that the blockchain failed. It is that systems trusted to control billions of dollars may have been compromised. The weakest point in institutional crypto custody may no longer be the technology holding the assets, but the people and infrastructure authorised to move them.
“We may be witnessing the industrialisation of state-sponsored crime. If North Korean involvement is confirmed, this is not simply a criminal group exploiting a weakness within an exchange. It is a state-linked operation capable of extracting significant sums from global financial infrastructure in minutes.That demands a very different response from governments.”
Kalyeena Makortoff
Elsewhere in the financial world, NatWest has rounded out the Q3 bank earnings season with a bit of a whimper.
Pre-tax profits were up just 1.9% for the July to September period, hitting £2.2bn.
That’s despite an 8.9% rise in net interest income to £3.6bn, having been offset by an 81% jump in impairment charges – the sums they use for soured loans – from £153m to £277m.
However, NatWest said that impairment charge increase is a comparative issue, reflecting the one-off release of provisions last year, rather than any change in conditions for its borrowers, which has remained stable.
They’ve also reported higher operating costs, primarily linked to the integration of wealth management business, Evelyn Partners, which the bank bought earlier this year.
The Binance theft raises ‘serious questions’ for cryptocurrency exchanges, explains Jake Moore, global cybersecurity advisor at security firm ESET
“It is worrying just how quickly billions of dollars can disappear in a modern-day cyber heist, but it is unbelievable that a single laptop has enough privileged access to enable it. If a single device can authorise enormous cryptocurrency transfers, hackers can simply target systems and people until they find a weak link. And there is always one.
“While blockchain transactions can be traced, recovering stolen cryptocurrency is far more difficult, especially when attackers move funds across multiple wallets and blockchains extremely quickly using simple and well-known evasion tactics. North Korea has become increasingly sophisticated in using cybercrime to generate enormous sums of money, but this raises serious questions as to whether cryptocurrency exchanges are doing enough to protect customer assets and whether security and regulation is keeping up.
“Consumers who choose to keep cryptocurrencies should spread their digital assets across multiple reputable platforms and secure hardware wallets (such as their own USB) to reduce the risk of losing everything in a single attack.”
News of the Binance heist could knock confidence in crypto assets, suggests Cristiano Ventricelli, vice president of digital assets at Moody’s Ratings
“The incident underscores the heightened cybersecurity risks associated with hot wallets, a component already exposed by the 2025 hack on Bybit cryptocurrency exchange. It also illustrates the risk concentration inherent in large, centralized intermediaries.
Stronger institutional controls can reduce some vulnerabilities, but the scale of assets under custody can amplify the impact of a successful breach.
The broader credit and industry implications will depend on the ultimate losses, affected counterparties, asset recovery, and importantly, whether the incident leads to wider disruption or loss of confidence across the digital-asset ecosystem.”
Blockchain analysis company Chainalysis also believed the Binance hack was probably conducted by North Korea’s TraderTraitor.
Chainalysis co-founder and CEO Jonathan Levin wrote on X:
We live in unprecedented times. But DPRK are up to their old tricks. We assess @binance hack for $6.4B was likely done by DPRK group TraderTraitor due to links to previous hack.
Industry partners have already frozen ~$3B and we @chainalysis continue to follow all of the funds.
TRM have also produced a breakdown of the digital assets swiped from Binance.
They say:
Ethereum accounts for about $3.79bn. That includes 200,630 ETH and 185 other tokens, among them 1.875 billion USDT, 823 million USDC and 88.5 million RLUSD.
Bitcoin outflows total 18,270 BTC, about $1.47bn.
Tron outflows total 612.7 million USDT and 46.4 million TRX, about $628m.
The XRP Ledger lost 233.46 million XRP, about $296m.
Solana outflows total 970,500 SOL, about $96m.
Arbitrum, Optimism and Base combine to about $39m, including 74.6 million ARB taken on Arbitrum. Avalanche outflows total about $28m, and Polygon outflows total about $10m.
