Blockchain analytics firm Chainalysis published findings on October 31, 2026 describing the laundering technique used by hackers behind the roughly $6.3 billion theft from Binance to keep stolen stablecoins out of reach of their issuers, Circle and Tether. The method, built around decentralised finance protocols on the Tron network, allowed the attackers to sidestep the freeze powers that normally give centralised stablecoin issuers a key advantage over law enforcement-resistant assets like Bitcoin.
According to Chainalysis, the attackers converted TRX into stablecoins and deposited them into DeFi lending protocols on Tron in exchange for deposit receipt tokens. These receipts function as digital proof certifying ownership of the underlying deposit, redeemable later by whoever holds them.
"Stablecoins offer liquidity and stability, with one drawback: freeze risk. The longer they hold illicit funds in stablecoins, the more likely it is that their centralized issuer will freeze tokens," Chainalysis said.
The firm illustrated the mechanism with a sample of $500,000. In that case, the non-freezable receipts obtained on Tron were transferred to clean wallets, then reconverted back into stablecoins and routed through cross-chain bridges to Ethereum, where they were exchanged for ETH.
"Unlike the stablecoins they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whoever holds them. That is an advantage for potential hackers and money launderers. Especially for North Korean threat actors, who have used this method in other thefts as well," Chainalysis said.
The firm added a caveat: "Of course, exchanging stablecoins for ETH does not make the hackers bulletproof." Circle and Tether have so far collaborated to freeze approximately $2.8 billion tied to the incident.
Attribution to TraderTraitor
Chainalysis attributed the Binance attack to TraderTraitor, a group linked to North Korea, based on its observation that the stolen funds were mixed in real time with assets from the theft of Bitget, which lost $388 million on September 24, 2026.
DDoS attacks on tracking tools
An analyst using the pseudonym CyberSatoshi said the group also carried out distributed denial-of-service attacks against visual blockchain tracking platforms used by investigators. The strategy involved fragmenting stolen funds into tens of thousands of microtransactions processed within a small number of blocks, a volume designed to saturate the GPU and CPU computing capacity of forensic servers attempting to trace the flow of funds in real time.
