The Big Picture: Tracking the Flow of $3.7B in Assets

Recent on-chain analysis has shed light on a significant incident involving the abnormal movement of digital assets, with a total value approximating $3.7 billion linked to Binance-associated addresses. The current status and specific pathways of these funds are coming into focus.

Swift Stablecoin Freezes and the Attacker's Initial Moves

On the Ethereum network, the attacker consolidated assets from multiple sources before splitting them. In response, stablecoin issuers Tether and Circle acted decisively, freezing approximately $2.2 billion in assets. This includes 1.38 billion USDT and 823 million USDC spread across three addresses.

Prior to the freezes taking effect, the attacker had already converted around $435 million worth of USDT into ETH via decentralized exchange protocols including 0x Protocol, 1inch, LiFi, and Uniswap. An additional $60 million in USDT was locked as collateral on Aave v3, facilitating a loan of about 19,800 WETH.

Assets Currently Under the Attacker's Control and Ongoing Activity

The attacker retains control of substantial holdings. Their current portfolio consists of:

  • 462,600 ETH: Valued at roughly $1.04 billion at current prices, this stash is dispersed across 11 addresses, with 85% concentrated in just three of them.
  • Approximately $400 million in other tokens: This includes XAUT, WBETH, ENA, RLUSD, USD1, and a long list of smaller-cap altcoins. Monitoring indicates the attacker is methodically selling these tokens into decentralized exchange liquidity pools, wallet by wallet.

A critical observation is that, so far, none of the funds have been routed through centralized exchanges, cross-chain bridges, or other services designed to obfuscate fund trails.

The Status of Bitcoin Holdings

The handling of the related Bitcoin assets followed a distinct pattern. A total of 18,270 BTC (worth approximately $1.42 billion) was moved from the original addresses. After passing through an intermediary address, it was distributed to 19 new Bitcoin addresses. Seventeen of these addresses each hold exactly 1,000 BTC. There has been no subsequent movement from any of these addresses since the transfer was completed.