$6 Million in Stolen Binance Bitcoin Is On the Move Again

A series of hops and "payments" shows that the Binance hackers are working to access some of their stolen millions.

AccessTimeIconJun 13, 2019 at 8:30 p.m. UTC
Updated Sep 13, 2021 at 9:18 a.m. UTC
10 Years of Decentralizing the Future
May 29-31, 2024 - Austin, TexasThe biggest and most established global hub for everything crypto, blockchain and Web3.Register Now

Hackers are now accessing wallets containing cryptocurrency stolen from Binance in May. Coinfirm, the company that tracked the original few moves in early May has spotted a massive outflow from the original hoard of wallets created on May 7, 2019.

Coinfirm's co-founder., Grant Blaisdell, wrote:

The attack was conducted using diversified techniques including viruses and phishing. According to Binance, stolen funds constituted approximately 2 percent of total BTC holdings of the exchange. In order to prevent user’s funds from being affected and guarantee stable work of the platform, Binance used its SAFU fund to cover the loses. The Secure Asset Fund for Users was established on July 14, 2018 and consists of 10 percent of all trading fees.

According to Coinfirm, the hackers then moved 1,060.64474480 BTC or $6,148,122.40 in a number of hops, shedding value each time. On June 7, 2019, the hacker moved the $6 million from this wallet, called bc1q2r..., to this wallet, bc1q65..., shedding an odd $15.84 dollars into this small wallet and adding $2 million to the total. It's not clear why this small an amount "hopped" out of the wallet.

The next hop moved 1,040.95915580 BTC ($8,242,840.00)  into this wallet, shedding $155,861.00 into another wallet, 1JSfJ.... This shows a concerted effort to break up the bigger wallets into smaller chunks.

Finally, Coinfirm saw a final hop of 1,021.53182514 BTC ($8,089,010.00) into this wallet, again shedding $153,835.00 into this wallet. The remaining BTC ended up in "bc1qcgwn2nv906k3rws803zhxwq3crfgjvnzjejgyq" and has not moved since.

screen-shot-2019-06-13-at-3-59-21-pm

This pattern of hops and "shedding" suggests either some sort of side payment to other parties or further efforts at laundering the cash using what appears to be a series of calculated moves aimed at scrambling the source of the funds. Given each of these wallets are now being watched carefully by legitimate exchanges it could be quite difficult - but not impossible - to convert these wallets to fiat.

Image via Shutterstock.

Disclosure

Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by Block.one; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.


Learn more about Consensus 2024, CoinDesk's longest-running and most influential event that brings together all sides of crypto, blockchain and Web3. Head to consensus.coindesk.com to register and buy your pass now.


Read more about