Global investigators race to recover billions after massive Binance crypto heist

Crypto firms and law enforcement are locked in a high-stakes race to recover more than $6 billion in cryptocurrency stolen from exchange Binance before hackers can launder the funds into cash. The heist began on Thursday at around 4pm ET, with hackers siphoning around $6.3 billion across multiple blockchains from wallets belonging to Binance in what appears to be the largest crypto heist of all time. Binance almost immediately suspended all deposits and withdrawals from its services while investigating the breach.

Investigation And Freezing

Tracing firms TRM Labs and Chainalysis have attributed the attack to a North Korean state-backed hacking group called TraderTraitor, while Elliptic's Tom Robinson noted the theft would almost double everything the regime has stolen in crypto to date. TRM analysis shows the majority of the stolen crypto was taken in a period of around 20 minutes on October 29 from hot wallets across at least ten blockchains, including Ethereum, Bitcoin, Tron, and Solana. Preparation began at least 36 hours before the theft, with the attacker testing code on wallets earlier that day. Stablecoin issuers such as Circle and Tether moved quickly to freeze funds, and Binance estimates around $3 billion worth of cryptocurrency has been frozen so far. However, hackers anticipated this move by selling USDT to market makers and borrowing ether against it, while also moving money to different Tron addresses.

Evasion Tactics

Hackers used automated money laundering patterns not seen before, repeatedly circulating funds back and forth between different addresses instead of simply moving them onward. They are also increasingly using Chinese professional money laundering organizations to turn crypto into fiat currency over the counter for a large fee. Binance has pledged to cover losses using its Secure Asset Fund for Users, while firms like TRM Labs, Chainalysis, and Elliptic continue working around the clock to track the remaining funds.

Context

Cryptocurrencies operate on public digital ledgers called blockchains, which allow forensic firms to track transactions across online wallets. When stolen digital assets are converted into cash through off-chain channels or specific tokens, freezing or seizing the funds becomes significantly harder for law enforcement agencies.