Analysis Reveals Automation Signs in 54% of Binance Theft Transactions

Overview of the Findings

On April 4, 2023, the on-chain investigator SomaXBT revealed that around 54% of the transactions related to the stolen funds from Binance, specifically involving Tron (TRX) and Solana (SOL), displayed signs of automation. This analysis was based on the timing of transactions and recurring transfer patterns, with data collected as of April 3, 2023, at 2:29 PM KST.

Transaction Details

The detailed analysis covered transactions from 10:37 AM to 2:09 PM on the same day, indicating that these movements occurred over a span of roughly 3.5 hours. It was noted that Solana funds moved through 34 intermediary wallets before being deposited into Jupiter Lend, with four wallets later withdrawing a total of 31,976 Solana in eight separate transactions.

Fund Movement and Conversions

The withdrawn funds were subsequently moved to newly created wallets, which were used to withdraw Solana multiple times. Notably, 20,760 Solana were exchanged for 2,486,734 USD Coin (USDC), a stablecoin pegged to the US dollar. Of this amount, 2,397,019 USDC was found to have been transferred through Circle's cross-chain pathway to 11 dYdX-related accounts. The analysis also documented several instances of quick deposits and withdrawals, suggesting potential automation in the transactions.

Uncertain Automation

SomaXBT clarified that the conclusion regarding automation is based on inferred patterns and timing, and not confirmed evidence. No direct proof was provided linking Jupiter, Circle, or dYdX to money laundering activities. Previous reports from Elliptic also indicated a potential for automation in 1,113 transfers from key Tron wallets associated with the Binance theft.