The Binance exploiters are rushing to stay a step of stablecoin freezes. One method we’re tracking involves stashing their stablecoins in DeFi protocols. Then claiming them back on new, clean addresses. This method has been used on the Tron blockchain since the early hours of the $6.4 billion attack. It involves swapping TRX for stablecoins, then exchanging those stablecoins for depository receipt tokens. Unlike the stablecons they represent, these receipt tokens cannot be frozen. But they can be exchanged for the stablecoins they represent by whomever holds them. That’s an edge for prospective hackers and money launderers. Especially North Korean threat actors, who have used this method on other heists, too. Here's how North Korea's TraderTraitor group moved $500K. Step by step. Step 1: Start with TRX. The hackers moved TRX into a swap wallet, positioning the funds for the next stage of the laundering process. Step 2: Swap into stablecoins. The hackers converted TRX into stablecoins through a DeFi exchange. The stablecoin offers liquidity and stability, with a catch: risk of freezing. The longer you hold illicit funds in stablecoins, the more likely its centralized issuer freezes your tokens. Circle and Tether have already contributed to $2.8 billion in freezes so far. This creates a critical vulnerability for the hackers and a potential intervention point for investigators. This is a dilemma for hackers — how to exploit stablecoin liquidity without the risk of freezing. Steps 3 and 4: Move the stablecoins: To solve the dilemma, the hackers moved the stablecoins and deposited them in a DeFi lending protocol. In return, they received a deposit token that could not be frozen. Rather than holding stablecoin directly, they now held a token representing a claim on pooled assets. They can now transfer the claim to the asset without risking a freeze. Steps 5 and 6: Move the claims token: The hacker moved their claim tokens to a new, clean wallet that was not tainted by association. That new wallet then converted the deposit token back to stablecoin. Steps 7 and 8: Bridge the funds. The hackers then exfiltrated their assets from the Tron blockchain via a bridge, swapping freezable stablecoins on one side with unfreezable ETH on the other. Now the exploiter is free of worry of a freeze. Of course, exchanging stablecoins for ETH does not make the hackers bulletproof. Chainalysis investigators analyze patterns like this to keep up with the hackers in real-time. We will continue to monitor how the blockchain is used and misused.

Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit. Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds. Rather than simply moving funds onward, they repeatedly circulate them among addresses, often sending funds back to addresses involved earlier in the sequence. Read more:

We are actively investigating the potential exploit of Binance in coordination with industry partners. At present we are monitoring funds moving across multiple blockchains, including Bitcoin, Ethereum, Tron, and a number of L2s, and will support Binance throughout this investigation.

Tokenization is widening the overseas market for US government debt. In our 2026 data, Italy, Portugal, and Singapore hold 66.9% of geolocated tokenized Treasury values. The US: 10.5%. Tokenization lowers minimum position size and removes the need for a US brokerage relationship, giving overseas investors another route to US government debt.

Agentic commerce is growing fast. Cumulative x402 transactions on @base: 58.8k in Q3 2025. 138.5M in Q3 2026. Transactions under a dollar do not make fiscal sense for a credit card network. Stablecoins that settle for under a cent do, so AI agents can pay per API call.

Chainalysis launched Operation Lighthouse, a first-of-its-kind sprint by law enforcement and the private sector to disrupt crypto-enabled CSAM networks. The multi-day operation generated 14,300 investigative leads, surfaced 7,700+ suspect accounts, and identified CSAM-linked suspects in 125 countries. Read more:

OFAC updated its sanctions against ISIS-K, adding 134 cryptocurrency wallets (131 TRON, 3 Monero) as identifiers. In a separate enforcement action, OFAC targeted individuals linked to the Latin American criminal group PCC for laundering illicit proceeds via crypto. Read more here:

Announcing Robinhood Chain support! 🚀 Chainalysis now supports Robinhood Chain, a permissionless layer 2 purpose-built for onchain financial services and tokenized real-world assets. We're excited to support the network as it grows and drives increased developer activity, retail participation, and onchain transaction volume. Customers can monitor Robinhood Chain activity through Chainalysis KYT, investigate fund flows in Reactor, and screen addresses across the network. Read more:

Live webinar tomorrow: AI agents for compliance. Learn how Chainalysis agents help compliance teams scale, reducing manual workflows and giving analysts more time for critical work. - Enrich alerts with behavioral, transactional, and exposure intelligence - Generate dashboards with natural language - Accelerate blockchain investigations Join the conversation on 2 July 2026 | 11 am GMT+8 | 1 pm AEST Register now:

Crypto stolen in the alleged $13.7 million hack of Grinex are moving. We’re tracking stolen funds as they flow through mixers and cross-chain bridges, with cash-out points at a mainstream exchange. This complicates recovery for the exchange’s users. But is it a hacker or an insider laundering the funds? Two months ago, Grinex (successor to Russian exchange Garantex) claimed it was hacked by “foreign intelligence services.” But on-chain evidence pointed to a possible inside job. For one, the alleged hacker swapped exfiltrated stablecoins for Tron (TRX) on a decentralized exchange that Garantex once favored. Most of the funds are still being held as balances on private wallets. Grinex claims on its website that it will compensate its customers for stolen assets — will these users get their funds back, or have they fallen victim to an exit scam?

Ethereum’s most notorious sandwich attacker just lost $7.5 million to a honeypot. Read our latest research explaining the theft, where the money’s gone, and how you can avoid getting hacked.

Yesterday, OFAC issued sanctions against ISIS-supporting financiers that moved crypto across borders for the terror group. Among the targets: Syria-based MSB Bitcoin Xchange and Turkish MSB Spider. Read more here:

🚨 Government teams: turn plain-language questions into illicit activity reports, enforcement dashboards, and automated investigative workflows with Chainalysis AI agents. 📺 Register now for our government-exclusive webinar:

🇧🇷 Brazil received ~$318B in crypto this past year—1/3 of LatAm’s total value. But growth attracts more than legitimate users. Our latest research reveals: - Cartel money laundering is the largest identified category of illicit inflows. - Russian sanctions evaders are increasingly utilizing local exchange infrastructure. - ~80% of illicit volumes went to just 5 deposit addresses. Read more here:

Not all sanctions exposure is equal. Pre-designation vs. post-designation changes everything, from due diligence to blocking obligations. Chainalysis gives compliance teams the temporal precision to know the difference. Read more here:

🤝 Chainalysis is proud to be a compliance partner for Exchange OS by @OKX, launching today on @XLayerOfficial. Read more about Exchange OS below, and how this is a structural step for onchain finance. 🚀

Every trade & settlement on @Polymarket is recorded on a public blockchain — a level of transparency traditional markets can't match. Today Polymarket announced it has selected Chainalysis to turn that transparency into the new standard for market integrity 🔗