Hackers linked to the Binance-related intrusion used previously unseen money-laundering patterns to move stolen funds rapidly through thousands of transactions, according to blockchain analytics firm Chainalysis.

The attackers repeatedly transferred assets among wallets, including sending funds back to addresses that had already appeared in the transaction trail. Instead of moving funds along a straightforward path from one wallet to another, they cycled the assets through a complex series of transactions. The speed and repetition of the movements suggest the process may have been automated, according to information shared by Coin Bureau in a post on X.

Repeated Wallet Transfers Complicate Tracking

The reported laundering activity is notable for the unusual structure of the transactions. The funds were not simply routed through a linear chain of newly created addresses. Instead, the attackers repeatedly moved assets among multiple wallets and revisited addresses that had already appeared in the transaction history.

Chainalysis described the activity as a previously unseen laundering pattern. The rapid circulation of funds through thousands of transactions, combined with repeated wallet transfers, suggests an effort to obscure the connection between the original stolen assets and their subsequent destinations.

That characterization carries weight because firms such as Chainalysis and Elliptic trace stolen cryptocurrency by analyzing activity recorded on public blockchains, and tracing methods that depend on recognized movement structures may face a harder task when funds are cycled through patterns that have not been catalogued before.

However, the available information does not establish that the attackers successfully concealed all of the funds or made them impossible to track. The activity appears intended to complicate blockchain tracing, but it does not by itself demonstrate that tracing efforts have been defeated.

Richard Teng Describes a “Self-Destruct Mechanism”

Binance CEO Richard Teng said the attackers used a “self-destruct mechanism” during the intrusion to destroy tools and traces. His description points to an effort to remove evidence associated with the attack, separate from the later movement of stolen assets through multiple wallet addresses.

The reported mechanism and the unusual transaction patterns represent two distinct aspects of the incident. The first concerns the destruction of tools and traces during the intrusion, while the second concerns the rapid movement of funds after they were stolen.

Early Findings Show Limited Use of Mixers and Exchanges

Early findings from blockchain analytics firm Elliptic indicated that almost none of the stolen funds had reached mixers, bridges or exchanges. That observation makes the repeated wallet-to-wallet transfers particularly notable: the funds were circulated through unusual transaction patterns instead of following routes commonly associated with those services.

The attackers also moved quickly to swap financially freezeable stablecoins into assets such as ETH and transfer funds between addresses before blacklist updates — a common response in which exchanges and stablecoin issuers restrict known tainted addresses — could catch up. According to information shared by Coin Bureau, those efforts were only partly successful.

The combination of repeated wallet transfers, rapid asset swaps and attempts to move funds ahead of blacklist updates illustrates the reported complexity of the laundering activity. Chainalysis’ identification of previously unseen patterns and Elliptic’s early findings provide separate perspectives on how the stolen assets were handled. The next meaningful signal will be where the funds surface: further updates from Chainalysis, Elliptic or Binance on the assets’ destinations would show whether the pattern ultimately complicated tracing, and whether any portion reaches the mixers, bridges or exchanges it has so far largely avoided.

Source: Hokanews