From
US blockchain analysis firm Chainalysis has spotted that the hackers behind the Binance theft are using “ never-seen-before” patterns to launder the stolen assets and stay ahead of the authorities.
They report that thousands of transactions have taken place in a short period, suggesting the attackers are using automation to obscure the trail of funds.
Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence.
Chainalysis explains:
double quotation markWhile billions of dollars in crypto under their control were denominated in unfreezable cryptocurrencies like Bitcoin and Ethereum, billions more were held in stablecoins like USDT and USDC that can be frozen. It was only a matter of time before the issuers of those stablecoins would freeze those funds — in coordination with law enforcement and industry partners such as Chainalysis.
Freezing funds takes time. The attacker attempted to stay ahead of that process by quickly moving $500 million of stablecoins into a wallet whose job it was to swap out those freezable assets to non-freezable assets. Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH. Ten minutes later, the exploiter sent the remaining $175 million in stablecoins to stopover wallets, likely trying to move faster than a blacklist or freeze. But the industry caught up with them more quickly than they expected: by 5:14 pm eastern the freezes started.
Key events
39m ago
Binance: We're conducting a full security review
45m ago
Binance: This was a complex attack
52m ago
Binance's Teng: We're working 'hand in hand' with global law enforcement
1h ago
FBI: We're engaged with partners over Binance hack
2h ago
Explainer: The Binance hack
3h ago
FBI and US Secret Service 'working with Binance' after $6.3 billion hack
4h ago
Hit by the Binance hack? Let us know!
4h ago
Binance promises to 'weather this storm' as asset recovery begins
5h ago
Chainalysis: Hackers using 'never-seen-before laundering patterns'
5h ago
UK financial watchdogs monitoring fallout from Binance heist
8h ago
Binance ‘working closely’ with law enforcement.
8h ago
Binance's Teng: Your money is safe
8h ago
Elite North Korean hackers blamed for Binance theft
8h ago
Bitcoin and crypto firms hit by Binance breach
8h ago
Binance freezes withdrawals after $6.3bn security breach
8h ago
Introduction: UK house price growth slowest since January 2024
There’s a risk that disruption in the cryptocurrency world spreads to mainstream finance, given financial institutions have been embracing crypto in recent years.
So explains professor Iwa Salami, professor of financial law and regulation and director of the Centre of FinTech at the University of East London (UEL):
double quotation mark“It would be misleading to suggest that mainstream finance, in the UK or internationally, is becoming reliant on crypto-assets. The growing interest among major financial institutions is primarily in blockchain technology and its applications, particularly asset tokenisation, payments and settlement. However, institutional exposure to crypto-assets, particularly Bitcoin and Ether, is also increasing through investment products and trading services.
“As these links deepen, risks originating in crypto markets could increasingly spill over into traditional finance, potentially posing wider financial stability risks. This reinforces the importance of robust regulation, effective risk management and oversight of the growing interconnectedness between crypto markets and mainstream finance.”
Tom Robinson, co-founder of analytics company Elliptic, has given the FT a pithy explanation of how hacking one developer’s laptop would have let the attackers into Binance:
double quotation mark“Binance’s engineers manage the systems that run the exchange.”
“A DevOps engineer’s laptop typically holds the access needed to log into those systems. An attacker who controls that laptop can use the same access.”
“They got Binance’s own systems to send the money for them.
Binance is working with law enforcement, blockchain intelligence firms, token issuers and other exchange to trace and recover stolen funds, Richard Teng continues.
Teng says, in his video message:
double quotation mark“We will do everything in our power to make sure that these bad actors are held accountable.”
Richard Teng adds that Binance is rebuilding its withdrawal service.
It will not be switched back on until it passes “rigorous testing”, he says, but adds that he’s “very hopeful” that users will be able to withdraw funds prior to the Sunday deadline.
Binance is also conducting a full security review, he continues.
And, the company intends to publish a proof of reserves report by Monday.
Richard Teng then confirms, in his video message, that the hack appears to have involve a compromised laptop – as reported a few hours ago.
However, he then reveals that Binance’s investigation has also uncovered “additional points of breach”.
Teng says
double quotation markThis was a complex attack. The attacker also used a self-destruct mechanism that destroyed tooling and traces as they want, making it more difficult for us to trace and investigate.
Teng has also explained that the attacker used a known multi-signature protocol, called eip-7702, to obtain on-chain execution approval over a hot wallet.
… Trimmed for readability. Visit the source for the full article.
Extracted and lightly reformatted for readability. · Source: pt