Blockchain data analytics firm Chainalysis said on Oct. 30 local time it assessed a $6.4 billion hacking incident at Binance as the work of the North Korea-linked cybercrime group TraderTraitor. It said the case was the largest theft in the history of digital assets.

According to Chainalysis, the attack began at about 4:20 p.m. Eastern time on Oct. 29. The attacker used a working wallet that received funds through Tornado Cash.

The attacker used valid signature approvals to make a Binance hot wallet execute code the attacker had deployed. Funds then flowed out across multiple blockchains in the form of normally signed transactions.

The attacker sought to swap stablecoins that issuers can freeze into other assets. After moving about $500 million worth of stablecoins to a separate wallet, the attacker exchanged $325 million into about $285 million worth of ether in about 20 minutes. The remaining $175 million was sent to an intermediary pass-through wallet about 10 minutes later.

Freezing measures began at about 5:14 p.m. that day. Chainalysis tracked fund flows with law enforcement agencies, stablecoin issuers and industry participants, and shared investigative leads first. About $2.8 billion had been frozen as of the time of the announcement.

Chainalysis said it confirmed in real time signs that stolen Binance funds mixed on-chain with funds from last month’s Bitget hack. The Bitget hack was previously identified as a case blamed on North Korea-related attackers. Chainalysis said the direct link it found between funds from the two incidents was the basis for its assessment.

Signs of automated money laundering also emerged. Thousands of transactions occurred in a short period. Funds moved between multiple wallets or returned to wallets used before. A pattern also repeated in which many wallets received exactly 1 tron (TRX), then received additional funds and passed them on to another wallet. Chainalysis assessed the attacker may have used automated programs to complicate the fund trail.

Chainalysis said it expected additional movement of the stolen funds over the coming days. It stressed that digital asset exchanges should have rapid incident response systems, as they can be persistent targets because they hold large amounts of assets.