Chainalysis Flags Automated Laundering Never Seen Before in $6.4B Binance Hack
Chainalysis says stolen Binance funds are moving through automated laundering patterns it has never seen, including repeated 1 TRX seeding of Tron addresses and mixing with proceeds of September's Bitget theft, as roughly $3 billion sits frozen.
Chainalysis says the stolen Binance funds are moving through laundering patterns its investigators have not seen before, with thousands of transactions in a short window pointing to automation. The firm put the theft at $6.4 billion and called it the largest crypto theft on record.
Chainalysis laid out what it is tracking on Oct. 30.
"Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit."
Chainalysis
The telltale sign is a repeated seeding step. Many addresses first received exactly 1 TRX, the native token of Tron, before accepting larger deposits and forwarding assets onward. Chainalysis said that sequence "suggests a programmatic process for moving and redistributing the stolen funds." Since our earlier coverage of the breach, the laundering trail has become the story to watch.
Mixing with Bitget loot
Chainalysis also saw the Binance proceeds mixing with funds from September's Bitget theft, which had previously been attributed to North Korean actors. That overlap strengthened its attribution to TraderTraitor, the group we reported TRM Labs also tied to the attack with high confidence. Elliptic has reached the same conclusion.
How the attacker raced the freezes
Chainalysis traced outflows to about 4:20 p.m. Eastern on Oct. 29 and found an Ethereum wallet funded through Tornado Cash. It submitted valid signed authorizations that let a Binance hot wallet run attacker-deployed software and move assets to attacker-controlled addresses.
The attacker knew stablecoin issuers can freeze tokens, and moved to get ahead of them.
"Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets."
Chainalysis
Over nearly 20 minutes, the wallet swapped $325 million of stablecoins for about $285 million in ether. Ten minutes later, the remaining $175 million went to intermediary wallets.
Freezes began by 5:14 p.m. Eastern. Chainalysis counted about $2.8 billion frozen on Oct. 30, while Binance put the figure near $3 billion, mostly USDT and USDC frozen by Tether and Circle. Even the headline loss is not settled: Chainalysis says $6.4 billion, other tallies put it around $6.3 billion.
Binance's response
Binance reserved more than $6.34 billion in company funds to cover the incident, excluding frozen assets. Of that, $5 billion was already held in the affected tokens, and market and OTC purchases were underway to cover the rest. Co-CEO Richard Teng disclosed additional breach points and bypassed approval controls, plus a self-destruct mechanism that destroyed tools and traces. Withdrawals were paused during security reviews while deposits stayed open.
What it means
For traders, the frozen $3 billion is the number that matters: nearly half the haul is stuck, and the issuers' freeze switch worked at the address level. The flip side is that the attacker's dash into ether shows how fast freezable assets can be turned into ones nobody can lock.
The $1 billion SAFU reserve covers only a fraction of the loss, leaving Binance leaning on corporate reserves. Rival exchanges are adjusting cold storage and calling for faster threat-intelligence sharing. The previous record, about $1.5 billion from Bybit in February 2025, was also tied to North Korean hackers. This theft is more than four times that size.
