Stolen Binance Funds Still Being Laundered Through Mixers, Researchers Claim

Funds from Binance's May hack are still moving through a mixing service according to research firm Clain

AccessTimeIconAug 9, 2019 at 8:00 p.m. UTC
Updated Sep 13, 2021 at 11:18 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Binance's recent hacker has been diligently washing funds stolen from the exchange back in May.

Clain.io, a Luxembourg-cryptocurrency capital flows research team, says the 7,074 stolen coins are being laundered through mixing service Chipmixer. Clain says at least 4,836 bitcoins were laundered since June 12.

A bitcoin tumbling service mixes bitcoins with other users' coins. Since bitcoins are attached to the publicly verifiable blockchain, mixing services are used to obfuscate transaction histories that follow bitcoins around.

Chipmixer was overwhelmed with the funds, Clain states. From June 12 onward, the hacker dumped funds into the mixer with abandon.

"It was pretty straightforward to trace the hacker's subsequent steps as it is practically impossible to launder big volume of coins in a relatively short period of time. Thus, we were able to detect the initial pool of hacker's addresses," the company wrote.

Clain says that Chipmixer has never handled inflows of such high volume, leading them to conclude that most funds coming out of Chipmixer today are related to one owner, the Binance hacker.

Image via Clain.io

Address analysis shows the hacker further breaking his loot into smaller sums of around 10 coins. Breaking the lump sum into small mixed batches is one way to prepare for off-ramping cryptocurrencies into fiat. Clain says 150 clusters were detected during the active mixing period and further believes some 5,300 bitcoin have been clustered overall.

Of the 4,836 coins tumbled, Clain has identified 183 bitcoins from the hacker with another 814 very likely to be from the hacker.

Clain's analysis shows little evidence to indicate any of the coins have hit the open market.

Image via CoinDesk archives

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.