Chainalysis: Hackers are using old tactics to transfer stolen funds from Binance, and transferring to ETH can still be tracked

Blockchain data analysis company Chainalysis stated on October 31 that addresses related to stolen funds from Binance are attempting to transfer assets before the stablecoins are frozen. One method they are tracking involves depositing stablecoins into DeFi protocols and then retrieving them with new addresses.

Chainalysis indicated that this method appeared early on the Tron blockchain following the approximately $6.4 billion attack. The related operations first convert TRX into stablecoins, and then into tokenized deposit receipts. These receipt tokens themselves cannot be frozen, but holders can exchange them back for the stablecoins they represent. The company noted that North Korean threat actors have used similar methods in other cases, citing the example of the TraderTraitor organization transferring $500,000.

According to Chainalysis, the related funds were deposited into DeFi lending protocols and received non-frozen deposit tokens, which were then transferred to a new wallet that was not associated and exchanged back for stablecoins, before being converted to ETH on Ethereum through a cross-chain bridge. The company also stated that Circle and Tether have participated in freezing approximately $2.8 billion to date. Chainalysis mentioned that converting stablecoins to ETH does not exempt attackers from being tracked, and its investigators are monitoring the related on-chain patterns in real-time.