Race to freeze $3 billion in stolen Binance crypto

Cryptocurrency investigators are engaged in a rapid effort to secure over $6 billion in assets stolen from Binance. The theft is currently under scrutiny by law enforcement and blockchain analysis firms.

The funds were targeted by a North Korean state-backed hacking group known as TraderTraitor. This group has a documented history of cyberattacks on crypto platforms. Experts describe the current situation as a "cat and mouse game" between the thieves and the trackers.

The primary goal of the hackers is to convert their digital coins into traditional fiat currency. This process is known as off-ramping. Ari Redbord, global head of policy at TRM Labs, stated that this conversion is the main challenge. He noted that the recovery effort is a race against time.

Binance has pledged to cover user losses using its Secure Asset Fund for Users. Both TRM Labs and Chainalysis have identified the TraderTraitor group as the likely culprit behind the breach. The firm estimates that approximately $3 billion worth of cryptocurrency has already been frozen.

Stablecoin issuers, including Circle and Tether, have moved to freeze their respective tokens. Stablecoins are digital assets that represent a currency like the dollar one-to-one. They are backed by assets such as government bonds or fiat currency. In some cases, issuers can burn and reissue these tokens to recover losses.

However, the hackers moved quickly to bypass this freeze. They sold USDT to market makers and borrowed ether against the stablecoin. Ether is more difficult to freeze than stablecoins. The lenders are now holding the stolen stablecoin while the hackers hold the borrowed ether.

Joe Hancock, a partner at law firm Mishcon de Reya, said the attackers anticipated the freeze. He explained that they knew this route would be closed to them. As a result, they moved ahead of the issuers to secure their position.

The remaining $3 billion in stolen funds is harder to track. Hackers use techniques to obscure their trail on public blockchains. These techniques include using crypto mixer services and automation to move funds between wallets. Jonathan Levin, CEO of Chainalysis, said there are no signs that mixers have been used yet.

Instead, Chainalysis observed new laundering patterns. The hackers use automation to send funds back and forth between different addresses. This circulation throws investigators off the trail. Levin noted that teams are working around the clock to follow these movements on the Tron blockchain.

Hackers are also using professional money laundering networks to convert crypto to fiat. These networks are often based in China. They buy the stolen crypto over the counter for a large fee. The money is then laundered and returned to the hackers in a form that is easier to exchange for cash.

Levin explained that as the funds move further away from the original hack, the opportunities for seizure decrease. Redbord said his company is becoming better at identifying these techniques. He described the ongoing effort as a continued struggle to track and trace the obfuscated transactions.