Chainalysis discovered that the stolen funds from Binance exhibited an automated money laundering pattern.

Chainalysis' investigation revealed an automated money laundering pattern in the Binance theft. Attackers used automated methods to initiate thousands of transactions within a short period, causing funds to repeatedly circulate and flow back between multiple addresses. Multiple addresses exhibited a pattern of first receiving 1 TRX and then receiving and transferring funds out. The attackers transferred $500 million in stablecoins to a redemption wallet, which then converted $325 million in stablecoins into $285 million in ETH within 20 minutes. The remaining $175 million was transferred to an intermediary wallet approximately 10 minutes later.