[DigitalToday reporter Chi-gyu Hwang (황치규)] An analysis has found that funds stolen from Binance are being laundered automatically by software.

On Oct. 29, about $6.43 billion was stolen in a hack across 11 blockchains at Binance. Of that, $2.85 billion was confirmed frozen.

On Oct. 31 local time, blockchain analytics firm Elliptic tracked movements of a key wallet on the Tron blockchain that handled distribution of the stolen funds. The wallet sent money out every hour for 31 hours. The longest pause was 46 minutes, and it did not stop at night. The interval between transfers was almost always at least 30 seconds. About 200 recipient wallets mostly forwarded the money elsewhere again within two minutes.

Amounts sent to Thorchain, an exchange service that swaps different blockchain assets, also repeated the same value each time after being exchanged.

Elliptic judged that the pattern makes it almost certain that software, not a person, is carrying out the money laundering. Elliptic said that in the Bybit hack, the laundering process followed human working patterns.

Elliptic stressed that because the program moves funds without rest, it is not enough to check a wallet only once. Elliptic explained that a wallet with no issues at the time of a check could receive funds from hacker-linked wallets a few hours later.

Elliptic recommended that corporate compliance teams check wallets frequently and set up alerts for suspicious transactions. It also released for free a list of wallet addresses used in the hack.

By fund route, Thorchain accounted for the most at $31 million. Sunswap followed with $5.3 million, Bitget Swap with $1.8 million and USDT0 with $400,000.

Elliptic again stressed that a single screening is not enough because laundering happens at machine speed. It said that wallets that pass screening can receive funds from hacker wallets a few hours later.

Elliptic published a collection of wallet addresses that the stolen funds passed through so anyone can check them for free.