Binance laundering operations continue unabated. On the other hand, hackers linked to North Korea removed approximately $242 million of the crypto assets they stole from the Tron network within two days. In addition, the FBI called on THORChain and other crypto services to block addresses linked to the attack.
How did the Binance laundering chain work?
First of all, according to data from on-chain analyst and Security Alliance (SEAL) contributor SomaXBT, attackers stole approximately 628 million dollars via Tron. They were able to launder $242 million of this in two days. However, Tether's freezing of 378.7 million USDT reduced the amount that needed to be moved to approximately $249 million.
During the Binance laundering process, approximately $194 million was moved out of Tron through bridges and exchange services. Additionally, approximately $26 million remained in the Tron network. Moreover, approximately $22 million was lost due to transaction fees, slippage and price movements.
Among cross-chain bridges, Relay ranked first with 48 million dollars. Then, $44 million was passed through THORChain, $32.1 million through Chainflip, and $16 million through Symbiosis. These four services processed approximately $140 million in total transactions. However, it could not be determined where the 41.7 million dollars transferred via Bitget Wallet went.
Binance suffered the largest crypto attack in history on Thursday, with the loss of approximately $6.3 billion in crypto assets. The FBI, along with the US Secret Service and IRS Criminal Investigation, issued an alert on Saturday. In this alert, the attack was attributed to the TraderTraitor group linked to North Korea.
FBI calls for blocking THORChain
According to the FBI, attackers mainly convert stolen assets into Ethereum. They can continue to launder them through DeFi protocols and instant exchange services. Therefore, the institution asked THORChain operators and other services to block relevant transactions.
The FBI released 608 Ethereum, 19 Bitcoin and one Solana address associated with the attack. However, Tron addresses were not included in the list. On the other hand, THORChain technical co-founder Chad Barraford said that operators do not have information other than publicly available information. He did not make a statement about whether the addresses would be blocked or not.
At the same time, a reorg in the Ethereum network led to a deposit of 10 ETH being refunded twice. That's why THORChain was immediately stopped. As a matter of fact, as of Sunday, operations were suspended in 10 of the 13 connected networks; Tron, Ethereum and Bitcoin were among them.
According to SomaXBT, attackers deposited 185.1 million TRX and 3.83 million USDT to THORChain in 2,697 transactions. Then, 17,019 ETH was sent from the system to 170 addresses and 53.25 BTC was sent to 20 addresses. However, there was a loss of approximately 12 percent due to wages and price shifts.
Transactions automated, 44 percent of funds frozen
According to Elliptic's analysis, the attackers' main Tron wallet made payments every hour for 31 hours. In addition, the same amounts were repeated in THORChain investments and some transactions occurred 19 times. Transactions rejected by the bridges were automatically resent to new wallets.
Elliptic co-founder Tom Robinson said there was no sign that the transactions were executed by artificial intelligence agents. Accordingly, people made the decisions. Repetitive transactions were automated with scripts, thus accelerating the Binance laundering process.
Elliptic confirmed that $2.85 billion in stolen assets were frozen or seized. This figure is approximately 44 percent of the company's estimated total loss of $6.43 billion. In particular, 94 percent of frozen funds consist of stablecoins.
On the other hand, assets worth approximately $3.25 billion cannot be frozen by their issuers. This amount includes 18,327 BTC and 233 million XRP. According to Tronscan data, the USDT frozen by Tether is in two wallets: 312.7 million USDT in one and 65.99 million USDT in the other. Finally, The Block's investigation showed that 18,270 BTC was still held at 19 Bitcoin addresses on the FBI list; This part of the Binance laundering chain has not moved yet.
