Elliptic tracked how stolen Binance funds moved across the Tron network and other blockchains via thousands of wallets and mixing services.
Elliptic tracked how stolen Binance funds moved across the Tron network and other blockchains via thousands of wallets and mixing services.
The recent Binance hack has become one of the largest cryptocurrency thefts recorded, with Elliptic estimating that approximately US$6.43 billion in digital assets were stolen on 29 October 2026.
Binance had temporarily suspended deposits and withdrawals following the attack, and the breach was linked to a compromised engineer’s laptop. The exchange said it would cover the losses, while blockchain intelligence firms and law enforcement agencies began tracking and freezing the stolen funds. The FBI subsequently attributed the attack to North Korea-linked hacking group TraderTraitor.
Elliptic’s investigation revealed an extensive laundering operation spanning 11 blockchains, approximately 12,000 wallets and more than 40,000 transactions in less than four days. Despite efforts to recover the assets, billions remain in addresses linked to the theft, with the funds moving through increasingly complex routes.
What Happened?
The theft occurred between 20:05 and 23:56 UTC on 29 October, involving assets held across 11 blockchains. Of the US$6.43 billion stolen, approximately US$3.46 billion, or 54%, was held in stablecoins such as USDT and USDC.
The attackers initially attempted to convert these stablecoins into assets that could not be frozen by their issuers, triggering a race against stablecoin issuers. Tether moved to freeze the stolen USDT on the Ethereum network, although around US$434 million had already been converted into ETH. On Tron, another US$234 million in USDT was converted into TRX before Tether froze the remaining funds. Circle, meanwhile, froze all US$823 million in stolen USDC before it could be converted.
On 29 October, 18,270 stolen BTC were split across 19 addresses and remained untouched as of Elliptic’s latest update. The attackers began distributing 684.6 million TRX across approximately 7,700 addresses on 30 October, before moving funds through several cross-chain bridges.
By 31 October, additional routes had emerged, including the use of a lending vault on JustLend to move 128 million TRX from one address into 16 new addresses without a direct transfer between them.
On 1 November, activity on Tron largely stopped as funds on other networks began moving again. ETH, SOL, and NEAR were transferred to new addresses, while some of the stolen funds were converted into BTC and sent through mixing services.
On 2 November, all 233 million stolen XRP were transferred to six new addresses. Some SOL also moved through a lending vault, following a similar approach to the earlier TRX transfers.
Tactics That Made Tracing Funds Difficult
Elliptic identified several established laundering techniques used together to make the stolen assets harder to trace.
First, the attackers distributed funds across thousands of wallets. Smaller transfers are harder to track individually and can be moved without significantly affecting market prices. The attackers also used at least seven cross-chain bridges to transfer assets between networks. These bridges receive tokens on one blockchain and release equivalent assets on another, creating separate transactions that complicate tracing.
The stolen funds were repeatedly exchanged for other assets via decentralised exchanges, changing their form as they moved between networks. This makes it more difficult to follow the original assets.
The attackers also routed funds through lending vaults. By depositing assets from one address and withdrawing them into several others, they avoided leaving direct transfer links between the sending and receiving wallets.
Additionally, they began using coinjoins through the WabiSabi protocol, which combines transactions from multiple users into a single transaction. This makes it harder to identify which incoming coins correspond to specific outgoing coins.
Where Are the Funds Now?
As of 2 November, approximately US$2.85 billion of the stolen assets had been frozen or seized, representing around 44% of the total. Another US$3.24 billion remained in addresses linked to the theft, mostly in ETH and BTC.
Much of the remaining BTC and ETH holdings has yet to move. The 18,270 BTC split across 19 addresses remains untouched, while approximately 68,700 ETH is distributed across around 850 smaller addresses. Nine of the largest Ethereum addresses hold 89% of the attackers’ ETH and have not moved since 30 October.
Despite the extensive movement between wallets and blockchains, Elliptic estimates that only a negligible amount has been cashed out so far. Most activity has involved converting the stolen assets into different cryptocurrencies rather than exchanging them for money through an external counterparty.
What Happens Next?
Elliptic expects the attackers to continue converting ETH into Bitcoin through multiple smaller transactions before attempting to cash out through over-the-counter (OTC) brokers and cryptocurrency exchanges.
Further recovery efforts may also prove challenging. Elliptic notes that freezing approximately 44% of the stolen assets is already unusual, compared with around 3% following the Bybit hack. Since ETH and BTC cannot be frozen by a central issuer, the remaining opportunities largely depend on intercepting stablecoins while they are being transferred or identifying the funds when they reach centralised services and OTC brokers.
Most notably, blockchain intelligence firm Chainalysis has been working with Binance, along with the public and private sectors, to disrupt laundering activity and recover funds.
Jonathan Levin, CEO and Co-Founder of Chainalysis, said: “As the stolen funds move through different channels, we’re working with partners to freeze as much as possible in real time. We have investigators working around the clock tracking funds and labelling addresses to deny the laundering teams cash-out points.”
While blockchain activity allows investigators to follow the funds across networks, converting them into spendable money requires cooperation from external counterparties, creating another opportunity for authorities and compliance teams to intervene.
Stay updated on crypto and AI by following our socials
