Binance Hacker Transfers $4 Million to Third-Party Service Addresses

The actor behind the massive Binance hot wallet exploit has initiated new movements of stolen funds. According to on-chain monitoring data from Arkham Intelligence, the hacker transferred approximately $4 million to three specific deposit addresses on the Binance platform. This activity follows the historic security breach on October 29, 2024, which resulted in the theft of an estimated $6.3 billion across multiple blockchain networks.

Laundering via Nested Services

Blockchain analysts believe that the destination addresses for these recent transfers likely belong to nested services. These are third-party cryptocurrency exchanges or payment processors that do not maintain their own independent infrastructure but instead utilize Binance for liquidity and custodial services. By routing funds through these intermediaries, attackers often attempt to obscure the direct link between stolen assets and the final exchange destination.

• Transaction Volume: Approximately $4 million in digital assets.
• Target Addresses: Three Binance deposit accounts linked to external providers.
• Primary Assets: The hacker has been actively converting various tokens into Ethereum (ETH) and Bitcoin (BTC) to maintain portability.

Broader Context of the $6.3 Billion Heist

The recent $4 million movement represents only a small fraction of the total loot. Following the initial drain, stablecoin issuers Tether and Circle moved quickly to freeze over $2.8 billion in USDT and USDC. Consequently, the attacker has shifted focus toward non-freezable assets. Reports from Lookonchain recently identified the conversion of nearly $96 million worth of Solana (SOL) into Bitcoin via the Relay Protocol.

Investigators have previously attributed the attack to the North Korean-linked group TraderTraitor, noting that the breach originated from a compromised DevOps engineer's laptop, allowing unauthorized access to service containers.

In response to the incident, Binance has utilized its SAFU (Secure Asset Fund for Users) and corporate reserves to cover 95% of the losses. While the exchange has begun a phased resumption of withdrawals—starting with the Bitcoin network on November 1—security teams continue to monitor all incoming transactions to intercept laundered funds as they return to the platform through nested entities.