How are hackers laundering the $6.3 billion in cryptocurrency stolen from Binance? - Vietnam.vn
Following the largest cryptocurrency heist in history, hackers have stolen $6.3 billion from Binance and are attempting to launder the funds through various cryptocurrency services.
After carrying out the largest cryptocurrency heist in history last week, stealing $6.3 billion from Binance, the mysterious hacking group immediately embarked on a large-scale money laundering operation. Within minutes, the stolen funds were divided among more than 10,000 digital wallets, according to blockchain analytics firm Chainalysis.
The hacking group attempted to transfer assets through multiple systems to evade detection by authorities and the freezing measures imposed by cryptocurrency companies. Just hours after the Binance attack, about half of the assets were frozen as stablecoin issuers like Tether and Circle blocked the associated wallets. However, according to blockchain tracing firms, $3.3 billion remains in the hands of the hackers.
Money Laundering Methods
To conceal the remaining funds, the hacking group further divided the assets into smaller amounts, then transferred them back and forth between multiple blockchain networks and transaction mixing services. This process created a complex network of transactions, making it difficult for experts to trace them.
One of the platforms used was THORChain, a service that allows the conversion of cryptocurrencies between different blockchain networks. According to Chainalysis, in just 72 hours after the Binance hack, THORChain processed over $46 million in stolen funds and collected over $200,000 in transaction fees. This money was distributed to those involved in operating the system.
During the same period, nearly $4 million more was transferred through Wasabi Wallet, a service that helps conceal the origin of cryptocurrency when transferring between Bitcoin wallets. Wasabi Wallet accomplishes this through a coordinating entity, whose job is to aggregate and process transactions to obscure the flow of funds.
It appears that providing tools to help avoid being traced after attacks or thefts has become part of the business for some cryptocurrency services.
Platform Responses
Last weekend, the FBI urged cryptocurrency services to block transactions related to the Binance hack, specifically naming the operators of the THORChain network nodes. However, the platform continued to operate, while the wallets involved in the theft continued to use Wasabi Wallet.
The developers of the two platforms argue that they are unable or not obligated to intervene when the service is used for illegal transactions. In an online radio program in October, Chad Barraford, the American co-founder of THORChain, asserted that the system is incapable of blocking individual transactions or digital wallets, as this function was not designed into the system.
Regarding Wasabi Wallet, Kruw previously stated that maintaining the privacy protection service stems from a belief in individual liberty and anarchist capitalism. While traditional financial institutions are required to monitor and report transactions showing signs of money laundering, the decentralized finance sector is not currently subject to similar strict regulation.
Decentralization Debate
The developers' claims that they cannot control transactions have led investigators and investors to question whether these platforms are truly decentralized. In the US, prosecutors have previously prosecuted operators of certain blockchain services on charges of intentionally assisting criminals in money laundering.
In 2025, investors in a lending platform built on THORChain sued two developers, Chad Barraford and John-Paul Thorbjornsen, questioning the decentralization of the system. According to the lawsuit, both parties had access to a special administrator key that allowed them to interfere with the platform's operations.
All blockchain systems charge a fee when someone uses them.
Thorbjornsen, a former Australian Air Force pilot, stated that he is no longer directly involved with THORChain. According to him, the developers have removed the controversial governance key, and the system now operates through 111 network nodes run by a number of unnamed individuals.
Related
