Stolen Binance Funds Still Being Laundered Through Mixers, Researchers Claim

May’s Binance hacker has been hard at work washing his stolen bitcoins through a mixing service.

Clain.io, a Luxembourg-cryptocurrency capital flows research team, says the 7,074 stolen coins are being laundered through mixing service Chipmixer. Clain says at least 4,836 bitcoins were laundered since June 12th.

A bitcoin tumbling service mixes a bitcoin’s unspent transaction outputs, or UTXOs, with other users’ coins. Since bitcoins are attached to the publicly verifiable blockchain with UTXOs, mixing services are used to obfuscate transaction histories that follow bitcoins around.

Chipmixer was overwhelmed with the funds, Clain states. From June 12th onward, the hacker dumped funds into the mixer with abandon.

“It was pretty straightforward to trace the hacker’s subsequent steps as it is practically impossible to launder big volume of coins in a relatively short period of time. Thus, we were able to detect the initial pool of hacker’s addresses,” the company wrote.

Clain says that Chipmixer has never handled inflows of such high volume, leading them to conclude that most funds coming out of Chipmixer today are related to one owner, the Binance hacker.

Image via Clain.io

Address analysis shows the hacker further breaker his loot into smaller sums of around 10 coins. Breaking the lump sum into small mixed batches is one way to prepare for off-ramping cryptocurrencies into fiat. Clain says 150 clusters were detected during the active mixing period and further believes some 5,300 bitcoin have been clustered overall.

Of the 4,836 coins tumbled, Clain has identified 183 bitcoins from the hacker with another 814 very likely to be from the hacker.

Clain’s analysis shows little evidence to indicate any of the coins have hit the open market.

Image via CoinDesk archives