Binance hack funds flow to Chinese launderers, Chainalysis says

Hackers behind the $6.3 billion theft from Binance Holdings are moving some of the stolen cryptocurrency through Chinese money-laundering networks, according to blockchain analytics firm Chainalysis.

The hackers, identified by U.S. authorities as members of North Korea’s TraderTraitor group, have been seen transferring stolen assets through thousands of digital wallets and across multiple blockchains in an effort to obscure their origins. North Korean hackers are said to have used Chinese money-laundering networks in previous thefts as well, and Chainalysis said that it’s tracked hundreds of thousands of dollars from the Binance theft — a fraction of the total stolen — flow into these networks.

The flows into money laundering networks, which include over-the-counter trading desks, suggest that hackers are pushing to take funds off of blockchain networks and cash them out, said Chainalysis.

Much of the broader activity has involved splitting funds into smaller amounts, swapping cryptocurrencies and transferring assets between blockchains. North Korea has denied it was behind the hack.

The hackers have already moved about $500 million through the blockchain TRON, according to Chainalysis. Attackers have spread that money out across more than 1,000 addresses, using various trading protocols on TRON — which has also been used for illicit transactions — to move the funds to wallets on Ethereum, Bitcoin and other networks.

Binance is working with law enforcement, blockchain intelligence firms, stablecoin issuers and others to trace and freeze assets connected to the attack, said a spokesperson by email. “Laundering attempts after an attack of this scale are expected, but they are not invisible,” said the spokesperson. “Every on-chain movement creates new intelligence for Binance, law enforcement, blockchain analytics firms, issuers and industry partners to trace, flag and freeze assets.”

A TRON DAO spokesperson said the company had a strong track record of working with law enforcement and analytics firms to “combat the use of blockchain technology for illicit purposes.”

“As an open-source, decentralized protocol, TRON is leveraged by independent third parties, which, as with any successful technology, can be abused by bad actors,” the company spokesperson added.

Crypto companies have frozen about $3 billion of the stolen assets, which prevents the hackers from moving the funds. Another $2.42 billion in crypto from the Binance hack lies in Bitcoin and Ether, funds the attackers have barely moved since the hack. The remaining assets, totaling nearly $1 billion, have started moving through what Chainalysis said were laundering rails.

Binance disclosed the theft on Oct. 29, in what has become the largest cryptocurrency hack on record. The exchange said Tuesday that the attackers used social-engineering tactics, including fake job interviews and malicious software, to gain access to its systems.

Chainalysis said only a negligible amount of the stolen assets appears to have flowed into Chinese money laundering networks so far. The firm expects the attackers to continue converting the cryptocurrency and eventually seek to cash out through brokers and exchanges, a process that could take months.