The hackers behind the record US$6.3-billion Binance theft are laundering the proceeds in ways investigators at blockchain analytics firm Chainalysis say they have not seen before, firing off thousands of transactions in what appears to be an automated effort to hide the trail.
“We are observing never-seen-before laundering patterns,” said Eric Jardine, head of research at Chainalysis, in a statement. “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”
Rather than simply moving funds onward, he said, the hackers repeatedly circulate them among addresses, often sending them back to wallets used earlier in the chain. Many addresses first receive exactly 1 TRX, the native token of the Tron blockchain, then receive more funds and pass them on – a sequence Jardine said “suggests a programmatic process for moving and redistributing the stolen funds”.
The findings add to a debate, covered by TechCentral last week, over whether AI is raising the risk for crypto exchanges. Chainalysis has not said AI is involved, only that the laundering is automated.
After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial.
Binance statement
In the first minutes, the attacker raced the stablecoin issuers, such as Tether and Circle, which can freeze their tokens. Over nearly 20 minutes, it swapped $325-million in stablecoins for $285-million in ether, which no issuer can freeze, according to Chainalysis. Freezes had begun by 11.14pm South African time on 29 October, less than an hour after the theft started. Chainalysis puts the frozen total at about $2.8-billion, and Binance has said it has located about $3-billion.
On Saturday, the FBI said North Korea was behind the theft of “more than $6-billion”, naming the activity TraderTraitor. It said the hackers were converting stolen assets “primarily into ethereum” and urged crypto firms to block transactions linked to a published list of addresses.
US President Donald Trump said later on Saturday that it remained unclear whether North Korea was involved. “We don’t know if it’s North Korea – but if it is, we’ll talk to North Korea about it,” he told reporters, according to Reuters. Pyongyang has long denied using state-linked cyber units for financial theft.
Chainalysis, which puts the haul at about $6.4-billion, says its strongest evidence came when its investigators “observed, in real time, funds stolen from Binance commingling with funds stolen in last month’s Bitget exploit”. The Bitget theft in September had been attributed to North Korea.
$3.6-billion out
Binance customers pulled a net $3.64-billion from the exchange after it began restoring withdrawals in phases at 8am South African time on Sunday. By 5.30pm it had processed $4.65-billion in withdrawals and $1.01-billion in deposits, a net outflow Binance put at 2.1% of its $171-billion in assets under management.
“After an initial spike, withdrawal volumes have declined and are stabilising as expected, while deposit volumes have remained substantial,” Binance said in a post on X.
Analytics platform DefiLlama showed higher outflows, first $4.36-billion and later $5.81-billion, Reuters reported on Monday. Binance told the news agency the first figure left out funds it had moved to its own new hot wallet, the internet-connected wallet an exchange uses to pay out withdrawals.
Binance said on Sunday it had replaced about 95% of the stolen assets after setting aside more than $6.34-billion of its own money. In a statement to TechCentral, Binance Africa said the money was coming from its corporate treasury, part of its Secure Asset Fund for Users (SAFU) and a portion of its futures insurance fund, “while ensuring the remaining fund balance stays above required risk-management levels”.
Binance has also revised its account of the breach. Its initial findings pointed to a compromised engineer’s laptop, but “our subsequent investigation has uncovered additional points of breach”, co-CEOs Yi He and Richard Teng said in a 30 October update. It has promised a post-incident report once its investigation is complete.
“Crypto exchanges are particularly attractive targets for hackers, regardless of where they are based, because, to borrow a line often attributed to bank robber Willie Sutton, ‘that’s where the money is’,” Jardine said. “Every exchange should remain vigilant.” — (c) 2026 NewsCentral Media, with additional reporting (c) 2026 Reuters
