Binance hackers used over 10,000 wallets to move stolen billions

Dubai: Hackers behind the $6.3 billion Binance cryptocurrency theft spread stolen funds across more than 10,000 digital wallets, using cryptocurrency services to move and obscure the money trail, according to a new Wall Street Journal investigation.

The November 7 report sheds light on how the attackers continued moving funds after the October 29 breach, despite efforts by blockchain companies and law enforcement agencies to freeze stolen assets.

The attackers divided the cryptocurrency into thousands of smaller holdings and moved portions through services that allow users to exchange assets between different blockchain networks.

Blockchain analytics firm Chainalysis found that more than $46 million in stolen assets passed through THORChain during the first 72 hours after the attack, according to the Journal.

The transactions generated more than $200,000 in fees for the service's operators.

Nearly $4 million was also routed through Wasabi Wallet, a Bitcoin privacy service designed to make transactions harder to trace.

The FBI urged cryptocurrency service operators, including those running THORChain nodes, to block transactions linked to the theft. However, some transactions continued.

Developers associated with decentralised cryptocurrency services have argued that their systems are not designed to give operators centralised control over individual transactions.

The dispute has raised questions about the responsibilities of platforms whose technology can move stolen funds.

In a separate investigation published on November 7, blockchain intelligence firm Bitquery said it had traced approximately $333 million in stolen cryptocurrency that was laundered or moved towards cash-out services during the first week after the breach.

The researchers found that about $208 million moved within the first two and a half days.

Bitquery identified THORChain as a major route, tracing approximately $113 million through the service across the period it examined.

The firm’s analysis covered transactions across nine blockchain networks. Its figures represent a different tracing period and methodology from those cited by the Journal and should not be combined.

Bitquery also found that much of the stolen Bitcoin and Ether remained in identifiable wallets during its investigation.

Stablecoin issuers and other organisations have frozen a substantial portion of the stolen cryptocurrency.

According to the Journal, approximately half of the stolen funds had been frozen, while blockchain tracing firms estimated that the attackers still controlled nearly $3 billion.

Freezing cryptocurrency can prevent it from being transferred, but does not necessarily mean the assets have been returned to Binance or their rightful owners.

The October 29 breach affected assets across several blockchain networks and prompted an international effort to track and restrict the movement of stolen funds.