Over $2.8 billion of $6.43 billion stolen from Binance frozen as hacker begins CoinJoin mixing, Elliptic reports
Blockchain analytics firm Elliptic reports that roughly 44% of the $6.43 billion stolen in the October 29 Binance hack has been frozen or seized, while the attacker has begun using CoinJoin to obscure stolen bitcoin.
Roughly $2.85 billion—around 44%—of the $6.43 billion stolen in the October 29 Binance hack has been frozen or seized by asset issuers and others as of November 2, according to blockchain analytics firm Elliptic. Laundered assets have moved through roughly 12,000 wallets across 11 blockchains in more than 40,000 transactions, with Tron serving as a primary pathway across about 7,700 addresses.[1][2][4][6]
An Elliptic breakdown shows that frozen balances include $1.87 billion in USDT on Ethereum, $823 million in USDC on Ethereum, $627 million in USDT and TRX on Tron, and $283 million in other freezable tokens. The attacker also swapped $931 million into ETH through decentralized exchanges and lending protocols, bridged $249 million after converting to TRX, and left $2.40 billion unconverted. In addition, about $16 million in stolen assets was mixed with funds originating from an earlier Bitget exploit.[2][4]
Roughly $3.24 billion remains in addresses tied to the hack, held predominantly as native ether and bitcoin. Amid ongoing tracking, the attacker has initiated mixing operations for the first time, funneling approximately 28 BTC through CoinJoin to conceal transactional origins. Commentator That Martini Guy noted that the hacker still holds upwards of $2.6 billion in unfrozen assets, comprising 18,270 BTC valued at roughly $1.42 billion, an ETH stack worth $1.22 billion, and other unfreezable holdings.[1][3][4][5][7]
Key facts
- Elliptic reports that about $2.85 billion (44%) of the $6.43 billion stolen from Binance has been frozen or seized as of November 2.
- The laundering operation has involved approximately 12,000 wallets across 11 blockchains in over 40,000 transactions, with roughly 7,700 addresses on Tron.
- The hacker began mixing funds for the first time by routing 28 BTC through CoinJoin.
- About $3.24 billion in stolen assets remains in attacker-controlled addresses, largely unconverted across native BTC and ETH.
- Elliptic documented that $16 million in stolen funds was mixed with proceeds from an earlier Bitget exploit.
- That Martini Guy reported the attacker retains more than $2.6 billion in unfrozen assets, including 18,270 BTC and an ETH stack worth $1.22 billion.
Sources · 7 sources
- TB
The Block@TheBlockCoPost on X ·
THE BLOCK: Funds stolen in the $6.4 billion Binance hack attributed to North Korean hackers have been moved through around 12,000 wallets across 11 blockchains in more than 40,000 transactions so far, according to Elliptic. About $3.24 billion remains in addresses linked to the theft, while the attackers have also begun using bitcoin coinjoins to obscure the funds' origins.
Open source - BM
Bitcoin Magazine@BitcoinMagazinePost on X ·
JUST IN: 44% of the $6.43 billion stolen from Binance has now been frozen or seized, according to Elliptic 👀 https://t.co/vZuMDipcoQ
Open source - TM
That Martini Guy ₿@MartiniGuyYTPost on X ·
The Binance Hacker still has over $2.6 billion in unfrozen funds The 18,270 BTC are worth $1.42 billion, and the ETH stack is worth $1.22 billion Alongside them, the hacker also has an abundance of other coins in the wallet that cannot be frozen at the current time https://t.co/A94cid1YN2
Open source - WB
Wu Blockchain@WuBlockchainPost on X ·
Elliptic: Binance Hacker Uses CoinJoin for First Time as 44% of Stolen Funds Are Frozen Elliptic said laundering of the roughly $6.43 billion stolen from Binance has involved 11 blockchains, around 12,000 wallets and more than 40,000 transactions. About $2.85 billion, or 44%, has been frozen or seized, while roughly $3.24 billion remains in linked addresses. Tron was a major route, with funds spread across about 7,700 addresses; the attacker has also begun using CoinJoin, while about $16 million was sent to addresses linked to the earlier Bitget hack.
Open source - SI
Solid Intel 📡@solidintel_xPost on X ·
INTEL: Binance hacker mixes stolen funds for the first time with 28 BTC run through CoinJoin, according to Elliptic
Open source - CN
crypto.news@cryptodotnewsPost on X ·
UPDATE: 44% of the $6.43B stolen from Binance has been frozen or seized Blockchain analytics firm Elliptic says nearly $2.83B of the stolen funds has been immobilized following the massive hack. https://t.co/LyZu402CeR
Open source - CB
Crypto Banter@crypto_banterPost on X ·
🚨$3.24B OF THE BINANCE STOLEN FUNDS STILL SITTING UNTOUCHED! @elliptic says roughly half of the $6.4B taken remains in addresses linked to the theft, mostly as ethereum:native and bitcoin:native. $2.85B has already been frozen. The first mixing has also started, with about 28 bitcoin:native put through coinjoins, mixing the bitcoin with other users’ coins so the trail is harder to follow.
Open source