Chainalysis said the $6.4 billion Binance hack was likely carried out by North Korea-linked TraderTraitor, with about $2.8 billion frozen so far.

Chainalysis said it assesses the $6.4 billion Binance hack to be the work of North Korea-linked cybercrime group TraderTraitor, describing the attack as the largest in crypto history and one of the biggest financial crimes ever recorded. The firm said its conclusion was based on on-chain activity observed in the hours after the Oct. 29 breach and on a direct link between funds stolen from Binance and funds stolen in last month’s Bitget exploit.

According to Chainalysis, funds began leaving Binance hot wallets across multiple blockchains at about 4:20 p.m. Eastern Time on Oct. 29. On Ethereum, the attacker used an operational wallet funded through Tornado Cash to submit valid signed authorizations that allowed a Binance hot wallet to run attacker-deployed code, after which assets were swept into attacker-controlled addresses. Across the affected blockchains, Chainalysis said the unauthorized transfers totaled approximately $6.4 billion.

The firm said the attacker then tried to move quickly before stablecoin issuers could freeze funds. It said about $500 million of stablecoins was routed into a wallet designed to swap freezable assets into non-freezable ones. Over nearly 20 minutes, that wallet swapped $325 million in stablecoins into $285 million in ether, while the remaining $175 million was sent to stopover wallets about 10 minutes later. Chainalysis said freezes began by 5:14 p.m. Eastern Time.

Chainalysis said several laundering patterns initially suggested TraderTraitor was responsible, but the strongest evidence came when investigators saw funds stolen from Binance commingling with funds stolen in the Bitget exploit, which had already been attributed to North Korean actors.

Source link