← The Polylog Crypto Intelligence Brief
Morning Edition · Saturday, October 31, 2026Published at 1:43 AM EDT · New York
Issuers freeze about $3 billion of Binance loot as the attackers switch to automated laundering that Chainalysis says it has not seen before
The attackers swapped $325 million of stablecoins for $285 million of ether. They gave up about $40 million to move into an asset no issuer can block.
Tether, Circle and other firms moved within hours to block billions of dollars of stolen tokens. Chainalysis counts $2.8 billion frozen so far, and Binance's partners put the figure near $3 billion. The freezes worked because a large share of the loot was in stablecoins, whose issuers can blacklist addresses. Freezing is not recovery. Legal experts quoted by CoinDesk said returning frozen tokens to Binance requires a separate legal process. They also questioned whether smaller victims would get the same fast action from issuers.
The attackers' response shows they expected freezes. Chainalysis found thousands of transactions in a short window and called the pattern "never-seen-before." According to the firm's findings, funds cycled among addresses and returned to wallets used earlier in the chain. Many addresses first received exactly 1 unit of TRX, Tron's native token, before they took larger sums. Chainalysis said this repeated sequence points to a programmed process. The attackers mixed Binance proceeds with funds from the September theft at Bitget, another exchange. They also exchanged $325 million of stablecoins for $285 million of ether.
The episode also produced an unusual side event. An address using the name "vtalik.eth", made to resemble Ethereum co-founder Vitalik Buterin's handle, sent an on-chain message to the attackers, according to the French-language channel Goku Crypto News. The channel says the message advised them on how to keep the stolen funds. Nothing ties the message to Buterin.
Veracity: Corroborated
80/100- If true, who benefits
Tether and Circle gain standing as cooperative enforcement partners of the United States government at a time when stablecoin rules are being written. Chainalysis gains when its own findings, including the claim that the laundering method is , support the North Korea attribution it sells to clients. Holders of assets no issuer can freeze gain a demonstrated use case in a crisis.
Part of a tracked trend
States Turn Crypto Rails Into Sanctions Instruments
Governments increasingly track, freeze, and seize on-chain assets to enforce sanctions, turning traceable ledgers and centrally controlled stablecoins into extensions of financial statecraft rather than escapes from it.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Binance traces $6.3 billion theft to one engineer's hacked laptop as investigators name North Korea's TraderTraitor
- EIP-7702 delegation let the Binance attacker sweep about $2.5 billion on Ethereum, and researchers propose narrower signing rules
- Aave reopens markets it froze after the Binance attacker borrowed 19,762 wrapped ether against stolen USDT
- Lummis says the stalled CLARITY Act would have sped up Binance freezes, while a critic says it would have required court orders
- Aztec discloses a critical flaw in its Alpha V5 proving system that left the network unable to tell which transactions it should have rejected
- Bridge and vault exploits cost zkLink Nova, an Avalanche tranche vault and Initia about $4.5 million combined
- Trezor tells buyers from reseller CryptoBilis to move funds after a report of a cellular implant inside a Safe 5
Comments
0No comments yet.