The Binance exploiters are rushing to stay a step of stablecoin freezes. One method we’re tracking involves stashing their stablecoins in DeFi protocols. Then claiming them back on new, clean addresses. This method has been used on the Tron blockchain since the early hours of the $6.4 billion attack. It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too. Here's how North Korea's TraderTraitor group moved $500K. Step by step. Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process. Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing. Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze. Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin. Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze. Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.