Chainalysis Attributes Binance’s $6.4B Exploit to TraderTraitor
Summary
Chainalysis assesses that North Korean group TraderTraitor carried out unauthorized transfers of about $6.4 billion from Binance wallets. Investigators cite on-chain links to funds from a prior Bitget exploit; about $2.8 billion has been frozen.
Key points
- Around 4:20 p.m. ET on October 29, funds began leaving Binance hot wallets across multiple blockchains; the unauthorized transfers totaled about $6.4 billion.
- On Ethereum, an attacker used an operational wallet funded through Tornado Cash to submit signed authorizations that enabled attacker-deployed code to sweep assets from a Binance hot wallet.
- The attacker moved $500 million in stablecoins in an apparent effort to swap them for assets less susceptible to issuer freezes; about $325 million was swapped into $285 million in ETH.
- Freezes began around 5:14 p.m. ET. Chainalysis says approximately $2.8 billion has been frozen through efforts involving investigators, law enforcement, stablecoin issuers and other industry participants.
- Chainalysis strengthened its assessment that TraderTraitor was responsible after observing Binance-linked funds commingled with funds from a prior Bitget exploit attributed to North Korean actors.
- Investigators observed thousands of transactions and repeated address-circulation patterns, including addresses receiving exactly 1 TRX before receiving and forwarding additional funds; they say this suggests automated laundering.
Article Details
- Victim Organization
- Binance
- Incident Type
- Cryptocurrency theft involving unauthorized transfers from Binance hot wallets across multiple blockchains.
- Operational Impact
- Approximately $6.4 billion USD in unauthorized transfers. Approximately $2.8 billion has been frozen so far.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed