According to CoinMeta, and based on the investigation by Chainalysis, it was found that the funds stolen from Binance involved an automated money laundering scheme. The attackers used automated methods to initiate thousands of transactions in a short period of time, causing the funds to circulate repeatedly between multiple addresses before flowing back. Multiple addresses showed a pattern of first receiving 1 unit of TRX, then receiving and transferring out the funds. The attackers transferred $500 million in stablecoins to an exchange wallet, which converted $325 million of those stablecoins into $285 million in ETH within 20 minutes; the remaining $175 million was then transferred to a transit wallet about 10 minutes later.