The hackers behind Binance’s 6.3 billion usd breach are deploying laundering tactics investigators have never seen before, converting roughly 786 million usd in stolen stablecoins through decentralized venues and accepting discounts of up to 26 percent just to move the money fast. Findings published Oct. 30 by blockchain analytics firms Chainalysis and Elliptic describe an operation that trades value for speed at every step, and a Bitcoin hoard that remains deliberately parked.
Automated wallet loops no one has seen before
Chainalysis said investigators identified thousands of transactions executed within short periods, suggesting the attackers used automation to obscure the movement of stolen funds. The attackers repeatedly circulate assets among interconnected addresses, sometimes returning funds to wallets used earlier in the laundering sequence to create dense, overlapping transaction histories the firm described as laundering patterns not seen before. A dense network links hundreds of wallets through several highly connected hubs.
On the Tron blockchain, investigators spotted a distinctive fingerprint: numerous wallets received exactly 1 TRX before accepting additional funds and forwarding them elsewhere. The repeated sequence suggests programmed instructions coordinating movements across a swarm of addresses, and it could bog down investigations that require analysts to untangle thousands of overlapping transfers by hand.
786 million usd in stablecoins swapped at fire-sale prices
Elliptic’s investigation quantified how aggressively the hackers have pushed stolen stablecoins through decentralized trading platforms before asset freezes could catch up. On Ethereum, the attackers converted approximately 434 million USDT into 160,451 ETH through Uniswap, 1inch, and market makers’ request-for-quote systems, executing at prices 12 percent to 26 percent worse than prevailing market rates. On Tron, they exchanged roughly 234 million USDT for 638 million TRX through SunSwap, and sold about 48 million usd of Ripple’s RLUSD stablecoin before further restrictions took hold.
Elliptic also identified sales of approximately 150 other stolen tokens, converted into ETH through decentralized exchanges. The pattern is rational even at a loss: consolidating into native assets like ETH and TRX matters because token issuers cannot directly freeze a native coin, unlike stablecoins they control. Paying 26 cents on the dollar in slippage is the price of escaping the freeze that ultimately caught about 3 billion usd of the loot.
18,270 BTC sitting still across 19 addresses
The stolen Bitcoin tells a different story. Elliptic found the attackers divided 18,270 BTC across 19 addresses through a series of smaller transfers, with most addresses holding roughly 1,000 BTC each. As of the firm’s Oct. 30 assessment, none of those holdings had reached an identified exchange or other service. That patience is strategic: Bitcoin has no issuer to freeze it, so the attackers face no clock on that portion of the haul, only the surveillance that watches every address.
Elliptic expects the attackers to eventually route more assets through additional wallets, cross-chain bridges, mixers, and trading services before attempting cash-outs through over-the-counter brokers and exchanges. The current activity, in other words, is likely phase one of a longer laundering campaign.
Why this shifts pressure onto DeFi
The data lands amid an intensifying debate over decentralized venues. When Tether and Circle froze billions in stolen stablecoins, the attackers’ response was to route around issuers entirely through DEXs, where no central operator can block a trade. Standard Chartered analysts argued this week that the Binance hack will accelerate institutional adoption of decentralized exchanges, but the same evidence gives regulators their strongest argument yet for policing DeFi front-ends and enforcing sanctions screening at the smart-contract layer.
For everyday users, the fallout is practical. Slippage from the hackers’ fire-sale conversions rippled through DEX pools and contributed to market pressure while Bitcoin traded down more than 4 percent on the day. And if compliance requirements tighten on the venues retail traders actually use, the cost of the hack will be paid in friction long after the stolen funds are traced or frozen.
Three things to watch: whether the 19 Bitcoin addresses move, whether stablecoin issuers extend freezes to the ETH and TRX the hackers consolidated into via exchanges, and whether the automated wallet-loop pattern resurfaces in future hacks now that it has proven effective once.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Crypto markets are volatile, and readers should do their own research before making any decisions.
eating a 26 percent discount to move fast tells you everything about sanctions pressure. 786 million moved and they still took the haircut because frozen funds are worth zero
the haircut was the point. whoever left those DEX pools deep enough to absorb 786 million basically ran a fire sale for the hacker treasury
pools were deep because nobody can front-run a wallet sitting on 6 billion in stolen funds. the 12 to 26 percent spread was the price of moving without a counterparty asking questions
and the LPs on those routes took the other side without knowing it. 786 million through automated pools means passive liquidity financed the exit
the spread was the toll basically. no kyc anywhere on those routes so a quarter of the value is just what moving anonymously cost them
sending exactly 1 TRX to hundreds of wallets before activation is such a fingerprint. automation saves them time but it also gives investigators a pattern to map the whole network
@Gunnel R. right, and reusing earlier wallets to loop funds back through is what made the dense hubs visible. smart speed, dumb hygiene. they will get caught by their own shortcuts
dumb hygiene is generous. they reused hub wallets across chains too, the clustering work is basically done for Chainalysis at this point
reused hub wallets plus the 1 trx activations, they basically shipped investigators the network map for free. the 26 percent haircut bought speed and nothing else
they paid 26 percent for speed and still left the hub wallets linked. whatever opsec budget remained clearly wasnt spent on clustering hygiene
the 1 TRX trick cuts both ways. energy on Tron is cheap but thousands of activations add up, and every single one is a labeled data point for Chainalysis
every 1 TRX activation is a free label for the investigators. burning 26 percent for speed and still leaving that fingerprint lmao
thousands of activations at a fixed 1 trx is also just laziness. randomizing the amount costs nothing and removes the cleanest clustering signal investigators had
laziness or deadline pressure. the fixed 1 trx smells like one deployment script shipped in a hurry and nobody went back to randomize after it worked
meanwhile the stolen Bitcoin just sits parked. stablecoins get laundered through DEXs at a loss but BTC liquidity is too thin to move 6 billion without tanking the price. interesting trap
parked is right. 6 billion in BTC with nowhere to go. every OTC desk on earth is watching those addresses, first move gets flagged
which is why consolidating into ETH and TRX came first. the BTC moves last, through mixers and instant exchangers, months from now
consolidating into ETH and TRX makes sense, issuers cant freeze a native coin. the parked BTC is the real endgame, moving 18k coins at once would light up every desk on the planet
first move gets flagged and the fbi just joined the probe per the newer piece. that BTC pile might be the most watched collateral in history
and the fbi joining the probe per the newer report makes that pile radioactive. first onchain BTC move gets flagged at the deposit end before it even clears
and mixers wont save them either, anything coming out gets flagged instantly. that BTC is a permanent hostage pile
26 percent burned to move fast and they still reused known wallets. somewhere a sanctions officer is grading that trade
786 million routed through decentralized exchanges in days and people still argue DeFi is the problem. the rails worked exactly as designed, for the wrong people
burning 26 percent bought them 786m moved before the freeze net closed. expensive, but frozen funds are worth zero, the math is cold
frozen funds worth zero is the whole calc. 26 percent for 786m out the door is cheap next to the billions still sitting tagged onchain
chainalysis mapping the hub network within 48 hours proves the looping backfired. dense overlapping histories cluster faster than clean hops ever would