Investigators are in "relentless pursuit" to trace and recover stolen assets from the Binance cryptocurrency exchange before hackers can launder the money.

"Hackers are trying to convert cryptocurrency to fiat currency. That's the challenge, a race against time," Ari Redbord, Global Policy Director at TRM Labs - the data analytics company investigating the Binance cryptocurrency hack, told CNBC on October 30.

The hack that happened to Binance on October 29 is considered the largest scale in the history of digital currency exchanges with an estimated 6.3 billion USD stolen. Binance initially suggested that the hack may have originated from a compromised DevOps engineer's laptop. But on October 30, the exchange wrote on X: "Our subsequent investigation discovered additional intrusion points."

After the hack, several stablecoin issuers, including Circle with USDC and Tether with USDT, froze the funds. Binance estimates that of the $6.3 billion stolen, about $3 billion was frozen.

Stablecoins are digital currencies that are pegged to a currency, such as USD, at a 1:1 ratio and backed by assets such as government bonds or fiat currencies. Stablecoin issuers can burn and reissue tokens to recover lost funds.

In the case of Binance, a company like Circle or Tether would destroy frozen stablecoins, making them unusable for hackers. They can issue new stablecoins, which are held by a legitimate government agency and then returned to Binance.

However, according to TRM Labs, the hackers were one step ahead by quickly selling USDT to market makers and borrowing Ether by mortgaging the stablecoin. Ether is harder to freeze, while the organization lending to the hacker will keep the stolen stablecoins.

Cryptocurrencies operate on a blockchain network, which stores public transactions. This means investigators can track the movement of cryptocurrency between online wallets.

In the Binance hack, data analysis company Chainalysis also discovered money laundering models they had never seen before, in which hackers used automated tools to transfer money back and forth to distract investigators, avoid being traced and recover the remaining about 3 billion USD.

According to Chainalysis, instead of simply moving funds to the next address, they continuously cycle between addresses, often moving funds back to addresses that appeared earlier in the transaction chain.

"We have teams working around the clock to monitor. We also now have an automated tracing system, not just relying on manual operations," Jonathan Levin, CEO of Chainalysis, told CNBC.

While the hackers' tricks complicate the investigation process, Redbord said TRM Labs is getting better at identifying these tricks. "This is a non-stop chase, in which the bad guys try to hide transactions, and we work hard to track and trace," he commented.

Both TRM Labs and Chainalysis claim that the Binance hack was carried out by the North Korean hacker group TraderTraitor. However, the two companies said hackers are increasingly turning to Chinese money launderers to convert cryptocurrency into fiat currency. Therefore, they not only track North Korean hackers on the blockchain but also track professional money laundering networks.

The money launderer, Levin explained, would offer to buy the stolen cryptocurrency directly for a high fee and then launder the money and transfer it back to the hacker, possibly in the form of stablecoins. The amount can then be converted to fiat currency.

As hackers reach this stage, recovering stolen assets becomes more difficult. "The further they go, the less likely they are to recover their money," Levin said.

However, Binance pledged to "compensate all losses through the Secure Asset Fund for Users (SAFU) and company funds", affirming that user funds are still safe. SAFU was established by Binance in 2018 to protect users in emergency situations. The fund currently holds about one billion USD worth of Bitcoin.

Wall Street Journal quoted a Binance spokesperson as saying that the exchange set aside more than 6.3 billion USD from the company's funds, including money in the SAFU fund, to compensate users' affected assets. Of that, 5 billion USD was kept in the form of cryptocurrencies that hackers stole. The exchange is advancing this money and will repay itself with the frozen 3 billion USD after the money is released. Binance is also purchasing the remaining $1.3 billion in cryptocurrencies through market trading channels.

Although the hack was serious, the damage was still small compared to the size of Binance's total assets. According to blockchain data analysis firm Nansen, the exchange's wallets hold a total of $167 billion in crypto assets, including user funds, Binance's own assets, and reserves in the SAFU fund. Additionally, Binance also owns a number of assets that are not included in the blockchain data.

Binance said that after adding funds from reserves to hot wallets, users' cryptocurrency balances will not change. "We will weather this storm," a spokesperson told Wall Street Journal.

Thu Thao summary