Binance initially pointed to a compromised DevOps engineer’s laptop that let the attackers submit unauthorized withdrawal requests through internal systems. The company later said it found additional exploit points, while maintaining that it has not seen any evidence that any wallet private keys were stolen. It didn’t give details about the additional attack vectors.
Blockchain analysis firms, including Chainalysis and TRM Labs, linked the exploit with high confidence to North Korea’s hacker group responsible for previous large-scale thefts given the sophistication and speed of the attack.
Read all of CoinDesk’s coverage of the Binance hack here
Chainalysis said it is seeing money-laundering techniques it has never observed before. Thousands of transactions are taking place in a very short time, which suggests the attackers are using automated scripts rather than moving money by hand.
Instead of sending funds directly to a final destination, they are repeatedly circulating the coins among many addresses, often sending them back to wallets that appeared earlier in the chain.
One recurring pattern involves many addresses receiving exactly 1 TRX before receiving and immediately transferring larger amounts, which Chainalysis describes as a programmatic process designed to scramble the trail at scale.
Aidan Larkin, co-founder and CEO of Asset Reality, a seized-asset company, called the approach “agentic money laundering.”
Leave a Reply