Binance cyberattack: how North Korea launders the stolen $6.4B

Updated 3 November, 18:49 UTC. Corrected: the first engineer was compromised through a trojanised Homebrew installer in June, not a job interview; Binance's timeline is now in the article.

The money stolen from Binance on 29 October is being laundered by software running on a timetable, according to blockchain analysts tracking it. The FBI, which attributed the theft to North Korea's TraderTraitor activity on 31 October, has asked the services that the laundering depends on to block the addresses involved.

The FBI's alert lists 608 Ethereum addresses, plus separate lists of Bitcoin and Solana addresses, that it says hold or have held proceeds of the theft. It asks THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to block transactions "with or derived from" them. The agencies said the stolen assets were being converted mainly into Ether, ahead of further laundering through DeFi and instant swap services.

A laundering process that runs by itself

Chainalysis reported on 30 October that the funds were moving in thousands of transactions within a short period, circulating among addresses and often returning to addresses used earlier in the sequence. It attributed the pattern to automation.

Elliptic described the same behaviour in more detail. As of 08:11 UTC on 31 October, the main distribution wallet on the Tron blockchain had paid out every hour for 31 hours, with no gap longer than 46 minutes. Swaps into THORChain repeated the same amounts, one of them 19 times. When a bridge rejected deposits, the funds were sent again automatically from new wallets.

How the funds get past stablecoin freezes

Stablecoin issuers can freeze tokens held by known theft addresses. Chainalysis traced a method the thieves have used on Tron since the first hours to avoid that. They swapped TRX for stablecoins, deposited the stablecoins in a DeFi lending protocol and received deposit tokens in return. The issuer cannot freeze the deposit tokens. The thieves moved them to new wallets, redeemed them for stablecoins there and bridged the proceeds out to Ether.

Freezes have still caught a large share. By 30 October Elliptic had verified about $2.84 billion, 44% of the $6.43 billion taken, as frozen. Chainalysis said Circle and Tether had contributed to $2.8 billion in freezes.

One route stopped for an unrelated reason. On 31 October an Ethereum reorganisation caused THORChain to refund a 10 ETH deposit twice. That tripped an automatic solvency check and halted most of its cross-chain swaps, which has held up a significant amount of the laundering, Chainalysis said. THORChain's founder, who says he left the project long ago, wrote on 1 November that the halt was not made at anyone's request, that a fix should bring the network back online automatically, and that it would then be up to node operators to decide how to respond. THORChain has not said whether its nodes will act on the FBI's request.

What screening has to change

Because new addresses keep appearing, a wallet that passes a check today can receive stolen funds hours later. Elliptic advises exchanges and other services to screen continuously and set alerts rather than rely on one-off checks or static lists. Its free blocklist of exploit addresses is updated as investigators trace new ones. The FBI asks anyone with information to contact a field office or the Internet Crime Complaint Center at ic3.gov.

How the attackers got in

Binance published its preliminary findings on 3 November, describing what it called a "sophisticated, multi-stage campaign" against two engineers, as reported by The Hacker News. In June, a member of its wallet DevOps team searched for a popular AI tool and installed a trojanised Homebrew installer. Binance detected that and rotated credentials, but details of the engineer's role and colleagues had already leaked, and the engineer's computer later held a container deployment token.

In September, a second engineer was approached on a job site by someone posing as a project director, went through two rounds of interviews and was told to download an "assignment" that contained malware. On 20 October the attackers used that computer to abuse an internal AI tool and take control of the first engineer and a third, a wallet software engineer. Over about three hours on 29 October they logged on to the third engineer's computer, used the first engineer's credentials to deploy a container and ran a script that used the internal wallet signing service to send transactions outside the normal withdrawal process. On Ethereum they also used the EIP-7702 authorisation mechanism to give malicious contracts partial control of a hot wallet, according to ChainCatcher's summary.

Binance puts the assets involved at about $6.34 billion and says about $2.85 billion has been frozen or intercepted. It says it will cover the loss itself, had replenished 98% of the affected tokens by 31 October, has closed the attack paths it identified and is bringing in independent security experts. The Hacker News has the background on TraderTraitor's earlier thefts and methods.