Several DeFi protocols appear to have benefited from North Korean hackers moving hundreds of millions of dollars in crypto they stole from Binance on October 30.
On-chain investigations suggest the laundering operation generated more than $100,000 in protocol revenue per day for five services.
THORChain, Relay and SunSwap among the biggest beneficiaries
Blockchain Investigative Detective, November 2 job a breakdown of protocol revenue related to wallets associated with the Democratic People’s Republic of Korea (DPRK), with SunSwap, THORChain, Relay, Symbiosis, and Chainflip earning the most money.
According to the data, SunSwap generated $29,697 attributed to the hacker, while THORChain, in second place, earned $28,184. For its part, Relay earned just over $23,000, while Symbiosis earned just over half that. Chainflip finished in the top five, raising $7,433, bringing the total to $101,144.
The revenue increase was most pronounced at THORChain and Relay, whose daily revenues increased by 2,229% and 1,954%, respectively, compared to typical October levels. SunSwap saw an 815% jump, while Symbiosis and Chainflip saw gains of 358% and 194%.
According to the detective, the numbers are based on Elliptic and FBI hacking lists, as well as some additional wallets that have been traced to the chain. They also counted every Tron transfer between October 29 and November 1, with revenue calculated using DeFiLlama’s definition of what each protocol remains.
However, the investigator pointed out that they left out one possible entry because they weren’t 100% certain of their connection to the Binance attacker: a router contract named BWSwapRouterV1, which could have collected around $175,000 across 3,561 swaps worth around $58 million.
THORChain and Relay processed millions in stolen funds
A separate investigation conducted by SomaXBT trace Some $242 million moved through the Tron network in two days, a small portion of the $628 million the attacker initially stole from the network, with Tether freezing more than $378 million in USDT. According to on-chain analysts, there are still more than $3 billion in stolen funds left untouched in other blockchains.
THORChain was the hacker’s biggest exit route for that $242 million, as they used it to move over $48 million. According to SomaXBT’s investigations, the hackers ultimately received $42.7 million, after losing $5.7 million in fees and slippage, with the interfaces facilitating these transactions collecting approximately $95,000 in affiliate fees.
On November 1, the FBI officially blamed the Binance hack on North Korea’s TraderTraitor, and Relay, which in past attacks linked to this particular actor resulted in almost no action, this time reportedly handled a fairly large share, sending about $48 million into Ethereum, Bitcoin, and decentralized exchange Lighter. SomaXBT claims to have also traced $32.1 million and $16.0 million processed through Chainflip and Symbiosis respectively.
The article Stolen Binance Funds Generate Revenue Gains for DeFi Protocol: Investigator appeared first on CryptoPotato.
About the Author
