TRM Labs: Binance Hackers Used a Self-Minted Tron Token and Chained Bridges to Obscure the Trail

Blockchain analytics firm TRM Labs says the attackers behind the October 29 Binance hack have adopted new techniques to hide the link between stolen funds and fresh addresses. TRM attributes the theft with high confidence to TraderTraitor, a hacking group backed by North Korea, and observed three methods between October 31 and November 2.

First, the hackers created their own token on Tron. Several addresses bought the token with stolen funds, while another address received newly minted tokens for free and sold them, so value moved without direct transfers between suspect wallets. Second, one address deposited stablecoins on a lending platform and received a receipt token. Only that receipt was sent to a second address, which redeemed it for stablecoins, making the flow look like unrelated deposits and withdrawals. The link became visible only when the receipt transfer was traced as well.

Third, proceeds from one cross-chain bridge were sent directly to the deposit address of a second bridge, removing the intermediate wallet that could have alerted investigators or exchanges.

The techniques build on the rapid spread of the loot across many services in the first days after the attack. Crypto Insiders stresses that they do not erase the public transaction record; they make tracing slower and more labor-intensive. Binance says about $2.85 billion of the more than $6.3 billion taken has been frozen or intercepted so far.

Track the market yourself with AiTraderView’s FREE tools: Crypto Cockpit for charts and 75+ indicators, Crypto Screener to find setups, and Crypto Portfolio to follow your holdings. Just create a FREE account and try them yourself!

Sources:

• TRM Labs: Binance hack update, North Korea launders proceeds through self-minted tokens and chained bridges

• Crypto Insiders: Binance-hackers maken eigen cryptomunt om sporen te verbergen