According to Chainalysis, the hackers who attacked Binance are using highly convoluted schemes to launder the stolen funds—the money passes through thousands of transactions. North Korean operators move crypto between wallets, sometimes sending it back to addresses they had used before. The speed of the transactions and the repeated patterns point to an automated process designed to cover their tracks.
Preliminary data from Elliptic show that the attackers urgently exchanged the frozen stablecoins for Ether and began moving assets between addresses before those addresses were blacklisted. To do this, they used a DeFi project: they deposited 60 million USDT as collateral on the Aave platform and borrowed 19,762 ETH against it, worth approximately $44.6 million. Meanwhile, Tether blocked 1.77 billion USDT, and Circle blocked 825 million USDC. As a result, the funds deposited as collateral on Aave remained frozen, while the hackers managed to withdraw the borrowed Ether, albeit at a loss due to an unfavorable exchange rate.
Preliminary data from Elliptic show that the attackers urgently exchanged the frozen stablecoins for Ether and began moving assets between addresses before those addresses were blacklisted. To do this, they used a DeFi project: they deposited 60 million USDT as collateral on the Aave platform and borrowed 19,762 ETH against it, worth approximately $44.6 million. Meanwhile, Tether blocked 1.77 billion USDT, and Circle blocked 825 million USDC. As a result, the funds deposited as collateral on Aave remained frozen, while the hackers managed to withdraw the borrowed Ether, albeit at a loss due to an unfavorable exchange rate.
