Pinned Tweet
🚨 PSA: We continue to receive reports of third parties impersonating Chainalysis on various platforms. These scammers often use similar tactics and offer everything from help recovering lost funds to fake jobs usually in exchange for information or a fee. Our team works hard to cams and impersonations down as soon as they are discovered, however if you get any of these messages, or believe you may be the victim of a scam, contact local law enforcement. You can also let us know via spoof@chainalysis.com so we can continue to track and manage these scams proactively.
𝐖𝐞 𝐰𝐢𝐥𝐥 𝐍𝐄𝐕𝐄𝐑 𝐫𝐞𝐚𝐜𝐡 𝐨𝐮𝐭 𝐭𝐨 𝐲𝐨𝐮 𝐅𝐈𝐑𝐒𝐓. We also won’t:
💰Ask you for funds
💸Promise you recovery of lost funds from scams or hacks
📋Offer you a job in exchange for any type of “fee”
💻Ask you to provide your information via a link on text, messaging services or unverified email
📵Send you unsolicited phone calls, emails, WhatsApp, Signal, Telegram or text/SMS
🔗Reminder: Chainalysis primarily provides its products and services to public and private sector businesses, and does not engage in investigation assistance for individual victims
We have more tips you can use to verify if the contact is legitimate on our website: chainalysis.com/scams
𝐖𝐞 𝐰𝐢𝐥𝐥 𝐍𝐄𝐕𝐄𝐑 𝐫𝐞𝐚𝐜𝐡 𝐨𝐮𝐭 𝐭𝐨 𝐲𝐨𝐮 𝐅𝐈𝐑𝐒𝐓. We also won’t:
💰Ask you for funds
💸Promise you recovery of lost funds from scams or hacks
📋Offer you a job in exchange for any type of “fee”
💻Ask you to provide your information via a link on text, messaging services or unverified email
📵Send you unsolicited phone calls, emails, WhatsApp, Signal, Telegram or text/SMS
🔗Reminder: Chainalysis primarily provides its products and services to public and private sector businesses, and does not engage in investigation assistance for individual victims
We have more tips you can use to verify if the contact is legitimate on our website: chainalysis.com/scams
73
55
95
75,259
The $6.4B Binance theft by North Korean actors began with a fake job interview, per Binance's initial findings.
We have attributed more than $14.3M in losses over the past 18 months to similar DPRK-linked faked interview and malware schemes.
These schemes have spanned a wide range of targets, from individual crypto holders and private wallets to organizations, protocols, and DAOs.
Our analysis suggests these earlier compromises allowed North Korean actors to refine their methods on small targets before deploying them against higher-value targets.
Per Binance, attackers spent weeks building trust with an employee, first approaching the employee through a legitimate job platform with a fake job opportunity.
After two rounds of interviews with a fictitious company, the Binance employee was asked to download an interview assignment that contained malicious code.
From there, they deployed malware and exploited access to an internal AI tool to move deeper into Binance's system.
We have observed multiple similar cases in which victims had wallet private keys stolen from cloud storage following a malicious interview.
Our research also indicates that North Korean actors have used fake employment schemes for other cyber attacks.
For instance, they have used such schemes to conceal malware in public blockchains. We’ve found a fivefold surge in these blockchain-assisted cyberattacks over the past year
The same actors can exploit recruitment platforms, compromise corporate infrastructure, infiltrate legitimate businesses and use crypto to move the resulting proceeds.
Chainalysis closely monitors how DPRK actors use crypto to generate revenue, move and consolidate funds, and launder illicit proceeds.
Combined with traditional cybersecurity measures and threat intelligence, blockchain analysis can help organizations and investigators identify and freeze stolen funds.
It can also map DPRK's expanding financial networks and uncover procurement and payment patterns that can support sanctions investigations and enforcement.
The Binance investigation remains ongoing and we expect stolen funds to continue moving in the coming days.
We have attributed more than $14.3M in losses over the past 18 months to similar DPRK-linked faked interview and malware schemes.
These schemes have spanned a wide range of targets, from individual crypto holders and private wallets to organizations, protocols, and DAOs.
Our analysis suggests these earlier compromises allowed North Korean actors to refine their methods on small targets before deploying them against higher-value targets.
Per Binance, attackers spent weeks building trust with an employee, first approaching the employee through a legitimate job platform with a fake job opportunity.
After two rounds of interviews with a fictitious company, the Binance employee was asked to download an interview assignment that contained malicious code.
From there, they deployed malware and exploited access to an internal AI tool to move deeper into Binance's system.
We have observed multiple similar cases in which victims had wallet private keys stolen from cloud storage following a malicious interview.
Our research also indicates that North Korean actors have used fake employment schemes for other cyber attacks.
For instance, they have used such schemes to conceal malware in public blockchains. We’ve found a fivefold surge in these blockchain-assisted cyberattacks over the past year
The same actors can exploit recruitment platforms, compromise corporate infrastructure, infiltrate legitimate businesses and use crypto to move the resulting proceeds.
Chainalysis closely monitors how DPRK actors use crypto to generate revenue, move and consolidate funds, and launder illicit proceeds.
Combined with traditional cybersecurity measures and threat intelligence, blockchain analysis can help organizations and investigators identify and freeze stolen funds.
It can also map DPRK's expanding financial networks and uncover procurement and payment patterns that can support sanctions investigations and enforcement.
The Binance investigation remains ongoing and we expect stolen funds to continue moving in the coming days.
17
21
73
7,047
North Korean hackers stole at least $2.02B in crypto in all of 2025, bringing their all-time total to at least $6.75B.
The Binance hack alone moved ~$6.4B, 95% of that all-time total.
The DPRK continues to undertake significantly higher-value attacks than other threat actors orth Korean hackers strike, they target large services and aim for maximum impact.
The Binance hack alone moved ~$6.4B, 95% of that all-time total.
The DPRK continues to undertake significantly higher-value attacks than other threat actors orth Korean hackers strike, they target large services and aim for maximum impact.
4
14
36
4,964
Chainalysis retweeted
“Around 40 to 50% of the total amount that was stolen has already been frozen.”
Eric Jardine of @chainalysis on the response to the Binance hack:
• About $3B is frozen and set to be returned to Binance.
• Exchanges, analytics firms, law enforcement, and stablecoin issuers e and freeze the funds.
• More could be frozen as long as the rest stays onchain and isn’t cashed out to fiat.
Eric Jardine of @chainalysis on the response to the Binance hack:
• About $3B is frozen and set to be returned to Binance.
• Exchanges, analytics firms, law enforcement, and stablecoin issuers e and freeze the funds.
• More could be frozen as long as the rest stays onchain and isn’t cashed out to fiat.
12
5
18
12,411
Chainalysis retweeted
TODAY ON THE STARTING BLOCK:
We're joined by @chainalysis head of research Eric Jardine to discuss the latest details of the Binance hack.
Join us live on @TheBlockCo 🔽
x.com/i/broadcasts/2…
We're joined by @chainalysis head of research Eric Jardine to discuss the latest details of the Binance hack.
Join us live on @TheBlockCo 🔽
x.com/i/broadcasts/2…
1
1
11
1,256
Early this morning Mercado Bitcoin, Brazil’s largest crypto exchange, suffered a security incident that resulted in ~$49 million in stolen funds.
In the early hours of November 2 an attacker began moving assets held across 17 blockchains, working in waves to drain the estimated $49 million in various cryptocurrencies.
The first few hours of any hack are the most important for investigators. In that window of opportunity they can help freeze some assets, like centrally-issued stablecoins, before the attackers are able to convert them into harder-to-disrupt cryptocurrencies, like BTC and ETH.
We immediately mobilised our global team of investigators to lead the blockchain intelligence response, working closely with Mercado Bitcoin, law enforcement, and industry partners to help freeze nearly $10 million in stolen funds.
At 2:30 am ET a Mercado Bitcoin director phoned our in-country solutions expert with the news: the exchange had been hacked.
Within 30 minutes we made contact with law enforcement to relay freezable addresses.
By the time morning had arrived we had helped lock down stolen stablecoins. Our work led to millions of dollars in freezes in the hours that followed.
Over the course of this hack we communicated directly with Paxos, Anchorage Digital, Ripple, Circle, and Tether, working together with law enforcement to shut down stolen stablecoins.
Our investigators identified stolen funds held in USDT and rapidly traced them to addresses where the assets could potentially be frozen.
Using our established relationships with Tether and law enforcement, we escalated the relevant addresses and supporting intelligence, enabling Tether to take action and freeze over $9 million in stolen funds.
We’re continuing to trace the remaining funds, monitor their movement, and identify further opportunities for intervention.
In the early hours of November 2 an attacker began moving assets held across 17 blockchains, working in waves to drain the estimated $49 million in various cryptocurrencies.
The first few hours of any hack are the most important for investigators. In that window of opportunity they can help freeze some assets, like centrally-issued stablecoins, before the attackers are able to convert them into harder-to-disrupt cryptocurrencies, like BTC and ETH.
We immediately mobilised our global team of investigators to lead the blockchain intelligence response, working closely with Mercado Bitcoin, law enforcement, and industry partners to help freeze nearly $10 million in stolen funds.
At 2:30 am ET a Mercado Bitcoin director phoned our in-country solutions expert with the news: the exchange had been hacked.
Within 30 minutes we made contact with law enforcement to relay freezable addresses.
By the time morning had arrived we had helped lock down stolen stablecoins. Our work led to millions of dollars in freezes in the hours that followed.
Over the course of this hack we communicated directly with Paxos, Anchorage Digital, Ripple, Circle, and Tether, working together with law enforcement to shut down stolen stablecoins.
Our investigators identified stolen funds held in USDT and rapidly traced them to addresses where the assets could potentially be frozen.
Using our established relationships with Tether and law enforcement, we escalated the relevant addresses and supporting intelligence, enabling Tether to take action and freeze over $9 million in stolen funds.
We’re continuing to trace the remaining funds, monitor their movement, and identify further opportunities for intervention.
Atualização sobre o incidente: o Mercado Bitcoin assegura que você não terá nenhuma perda de ativos em razão do incidente de segurança que identificamos hoje em nossa plataforma.
Identificamos uma ocorrência em nossa plataforma na madrugada de hoje. Como medida preventiva para proteger integralmente os ativos dos clientes, acionamos nossos protocolos de segurança e suspendemos temporariamente o acesso aos serviços.
13
16
96
9,575
Read our blog on disrupting the Mercado Bitcoin attack for further details:
chainalysis.com/blog/chainalys…
chainalysis.com/blog/chainalys…
0
2
4
1,691
Our investigators are tracking the Mercado Bitcoin security incident and are working with industry partners to identify, freeze, and disrupt impacted funds.
Comunicado oficial:
Identificamos e contivemos com rapidez um incidente de segurança em um de nossos sistemas nesta madrugada.
Reforçamos que:
• Não houve nenhum prejuízo aos clientes;
• Não houve vazamento de dados.
Como medida preventiva de proteção, depósitos e saques estão temporariamente suspensos. Nossas equipes estão mobilizadas investigando o caso, rastreando os ativos e coordenando as medidas junto às autoridades competentes.
Manteremos atualizações regulares por aqui.
4
3
90
6,405
As of Nov 2, over $1B in ETH and ~$1.42 billion in BTC stolen from Binance have seen limited onward movement since the theft.
Other stolen funds are moving rapidly across chains.
These funds are not all progressing through the laundering process at the same pace.
Other stolen funds are moving rapidly across chains.
These funds are not all progressing through the laundering process at the same pace.
12
11
57
6,288
What differs is the circulation pattern: funds repeatedly return to earlier addresses across thousands of transactions.
This suggests automation and differs from laundering patterns we’ve previously observed.
These patterns alone do not establish that the attackers used AI.
This suggests automation and differs from laundering patterns we’ve previously observed.
These patterns alone do not establish that the attackers used AI.
2
1
4
623
We assess that the scale of the theft will strain the actors’ trusted laundering channels, pushing funds toward a broader network of services and laundering operators, including bridges, instant exchanges, and swappers.
We are tracing these flows and will continue to share updates.
We are tracing these flows and will continue to share updates.
0
0
2
507
North Korean-linked actors have begun a new phase of laundering the funds stolen from Binance.
After draining $500M from TRON staging wallets, the launderers have started moving onto Solana.
The Reactor graph below shows the scale across blockchains.
After draining $500M from TRON staging wallets, the launderers have started moving onto Solana.
The Reactor graph below shows the scale across blockchains.
44
99
439
69,812
Funds are leaving TRON via Chainflip, Relay, THORChain, NEAR, and other routes, reaching dozens of fresh wallets on Ethereum, Bitcoin, and other chains.
Transfers range from less than $5,000 to more than $100,000.
Transfers range from less than $5,000 to more than $100,000.
2
1
20
3,653
Chainalysis has attributed the downstream addresses and is tracing the funds across chains, including new activity on Solana.
More updates to follow.
More updates to follow.
0
1
17
2,790
THORChain just inadvertently delayed the laundering of a significant amount of funds stolen from Binance.
The reason? An Ethereum reorg.
One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH.
This triggered an ORChain, preventing all users, including DPRK’s money launderers, from using cross-chain swaps.
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.
The reason? An Ethereum reorg.
One happened this morning and caused THORChain to incorrectly issue a double refund to someone who had deposited 10 ETH.
This triggered an ORChain, preventing all users, including DPRK’s money launderers, from using cross-chain swaps.
Until the service comes back online, neither the hackers nor anyone else can swap through a majority of THORChain’s bridges.
38
47
308
124,530
The Binance exploiters are rushing to stay a step of stablecoin freezes. One method we’re tracking involves stashing their stablecoins in DeFi protocols. Then claiming them back on new, clean addresses.
This method has been used on the Tron blockchain since the early hours of . It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too.
Here's how North Korea's TraderTraitor group moved $500K. Step by step.
Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process.
Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing.
Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze.
Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin.
Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze.
Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.
This method has been used on the Tron blockchain since the early hours of . It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too.
Here's how North Korea's TraderTraitor group moved $500K. Step by step.
Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process.
Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing.
Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze.
Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin.
Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze.
Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.
57
92
481
53,172
Our Co-founder and CEO @jony_levin spoke with @BBCNews today on the Binance exploit.
6
8
48
5,904