Binance Hack: Firms Race to Trace Stolen Cryptocurrency
Crypto firms and law enforcement agencies are working to recover more than $6 billion in cryptocurrency stolen from Binance, according to the account provided. Binance says roughly $3 billion has been frozen, while investigators continue tracking the remaining funds. The exchange has pledged to cover user losses through its Secure Asset Fund for Users.
Blockchain analysis firms TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean state-backed hacking group. Their immediate challenge is to trace the stolen assets before the attackers can convert them into money that is harder to recover.
Stablecoin issuers Circle and Tether have frozen some affected tokens. Because those companies control the issuance of their respective stablecoins, frozen tokens could potentially be destroyed and replaced, creating a route to return the value. Investigators say the attackers anticipated that possibility. TRM Labs reported that they sold USDT to market makers and borrowed ether against stablecoin holdings. Unlike issuer-controlled stablecoins, ether cannot be frozen in the same way.
The public records maintained by blockchains allow investigators to follow transactions between wallets. However, Chainalysis says the attackers have repeatedly moved funds among addresses, sometimes returning them to wallets used earlier. Its chief executive, Jonathan Levin, said the firm had not observed the use of crypto mixers, which combine funds to make their origins harder to trace. He said investigators were monitoring transfers to addresses on the Tron blockchain.
Investigators also say professional money-laundering networks may play a role in converting stolen cryptocurrency into conventional currency. Such networks can buy crypto through private transactions and move value outside the visible blockchain trail. At that point, investigators may have fewer opportunities to seize the funds.
The case illustrates both the value and limits of blockchain tracing: transactions can be monitored, but recovery becomes more difficult as assets change form and pass through additional intermediaries. For now, the outcome depends on how much investigators can identify and secure.