USDT can be frozen, so why do hackers still get away? Chainalysis breaks down an 8-step money-laundering scheme involving $500,000
Yesterday we talked about how stablecoins have freeze buttons. Today, let’s talk about how hackers get around them. The method isn’t complicated: deposit stablecoins into DeFi and get a “receipt” in return—one that can’t be frozen.
Blockchain analytics firm Chainalysis publicly described a method it’s tracking on its official X account (October 31, 19:37 Beijing time), saying it had been used on the Tron network starting in the first few hours after this roughly $6.4 billion Binance theft. It broke down a transaction worth about $500,000. The process, in broad strokes, was:
1. First, move TRX into a wallet used specifically for swapping;
2. Swap TRX for stablecoins on a DeFi exchange;
3–4. Deposit the stablecoins into a DeFi lending protocol and receive a deposit receipt token in return;
5–6. Transfer the receipt to a new wallet with no prior connection to the stolen funds, then use that wallet to swap back into stablecoins;
7–8. Leave Tron via a cross-chain bridge, swapping “freezable stablecoins” for “unfreezable ETH.”
The key is step 3. A deposit receipt represents a claim on the funds in a pool; whoever holds it can redeem it. Issuers can freeze USDT or USDC held in their own contracts, but they can’t freeze a receipt that says, “I have funds in the pool.”
So the protection offered by “freezable stablecoins” only applies while the assets remain in stablecoin form. Chainalysis said Circle and Tether have so far participated in freezing about $2.8 billion; but it also acknowledged that the other side is simply racing to act before the freeze.
A few things to be clear about:
- Chainalysis didn’t name the lending protocol, and I won’t guess;
- It also said that swapping into ETH doesn’t mean the funds are safe—on-chain analysis is still tracking them in real time;
- Its blog also noted signs of automated money laundering: thousands of transactions in a short period, with many addresses first receiving exactly 1 TRX.
For ordinary users, there’s just one rule: don’t touch, swap, or transfer receipt tokens or small airdrops sent to your wallet from unknown sources. They may already be flagged by on-chain analytics, and interacting with them could drag your account into the mess too.
Do you think stablecoin issuers will start keeping an eye on these “receipts” next?
$USDT $TRX #链上安全 #MoneyLaunderingTracking
Yesterday we talked about how stablecoins have freeze buttons. Today, let’s talk about how hackers get around them. The method isn’t complicated: deposit stablecoins into DeFi and get a “receipt” in return—one that can’t be frozen.
Blockchain analytics firm Chainalysis publicly described a method it’s tracking on its official X account (October 31, 19:37 Beijing time), saying it had been used on the Tron network starting in the first few hours after this roughly $6.4 billion Binance theft. It broke down a transaction worth about $500,000. The process, in broad strokes, was:
1. First, move TRX into a wallet used specifically for swapping;
2. Swap TRX for stablecoins on a DeFi exchange;
3–4. Deposit the stablecoins into a DeFi lending protocol and receive a deposit receipt token in return;
5–6. Transfer the receipt to a new wallet with no prior connection to the stolen funds, then use that wallet to swap back into stablecoins;
7–8. Leave Tron via a cross-chain bridge, swapping “freezable stablecoins” for “unfreezable ETH.”
The key is step 3. A deposit receipt represents a claim on the funds in a pool; whoever holds it can redeem it. Issuers can freeze USDT or USDC held in their own contracts, but they can’t freeze a receipt that says, “I have funds in the pool.”
So the protection offered by “freezable stablecoins” only applies while the assets remain in stablecoin form. Chainalysis said Circle and Tether have so far participated in freezing about $2.8 billion; but it also acknowledged that the other side is simply racing to act before the freeze.
A few things to be clear about:
- Chainalysis didn’t name the lending protocol, and I won’t guess;
- It also said that swapping into ETH doesn’t mean the funds are safe—on-chain analysis is still tracking them in real time;
- Its blog also noted signs of automated money laundering: thousands of transactions in a short period, with many addresses first receiving exactly 1 TRX.
For ordinary users, there’s just one rule: don’t touch, swap, or transfer receipt tokens or small airdrops sent to your wallet from unknown sources. They may already be flagged by on-chain analytics, and interacting with them could drag your account into the mess too.
Do you think stablecoin issuers will start keeping an eye on these “receipts” next?
$USDT $TRX #链上安全 #MoneyLaunderingTracking
