TechFlow News, October 31 — According to Chainalysis monitoring, the Binance hacker used deposit receipts from a DeFi lending protocol on the Tron network to transfer the right to redeem stablecoins, circumventing freezes by issuers. The firm illustrated the process using $500,000 in funds it attributed to North Korea’s TraderTraitor group.

The attacker first exchanged TRX for stablecoins, deposited them into a lending protocol and received deposit receipts. They then transferred the receipts to a new wallet, which redeemed the stablecoins, and subsequently exchanged them for ETH via a cross-chain bridge. Deposit receipts represent a claim on assets in the protocol pool and are separate from the freeze controls on the underlying stablecoins.

Chainalysis says this method has been used since the early stages of the attack; Circle and Tether have helped freeze approximately $2.8 billion in related assets.