Binance Hack Funds Spread Across 12,000 Wallets in Under Four Days

Funds stolen from Binance passed through approximately 12,000 wallets in under four days, Elliptic found. The operation spanned 11 blockchains, while the firm assessed that only a negligible amount had likely been cashed out.

Thousands of Wallets Expand the Laundering Trail

Crypto assets stolen from Binance moved through approximately 12,000 wallets across 11 blockchains in under four days, blockchain analytics firm Elliptic reported on Nov. 2. Its analysis of the 12,000-wallet laundering operation tracked more than 40,000 transactions following the Oct. 29 theft of $6.43 billion. Elliptic stated:

“The laundering is highly complex and clearly automated.”

Chainalysis had identified suspected automated laundering patterns on Oct. 30, observing repeated transfers between addresses and returns to wallets used earlier. Many receiving addresses obtained exactly 1 TRX, Tron’s native cryptocurrency, for transaction fees before accepting and forwarding larger balances. That recurring sequence suggested software was redistributing the proceeds.

The theft itself involved additional entry points and bypassed approval controls, Binance co-CEO Richard Teng said in a video shared Oct. 30. He described an investigation extending beyond an initially suspected compromised laptop. A self-destruct mechanism also destroyed attack tools and traces, complicating the exchange’s investigation.

Automated Transfers Lead Into Vaults and Bitcoin Mixing

Elliptic identified fixed timing, set amounts, and blind retries. Those patterns pointed to conventional software scripts. The firm found no evidence that artificial intelligence software was making decisions about the transfers.

The attacker also used lending vaults, protocol contracts that accept deposits and process withdrawals, to deposit from one address and withdraw to others without a direct transfer between them. Bitcoin mixing began Nov. 1, with approximately 28 BTC, worth $2.2 million, passing through 18 coinjoins by early Nov. 2. Coinjoins combine multiple users’ bitcoin inputs and outputs in shared transactions, making individual movements harder to trace.

Attempts to move assets intersected with Thorchain’s emergency swapping pause. The protocol, which enables cryptocurrency swaps across blockchains, activated safeguards after an accounting discrepancy involving 10 ETH on Oct. 31. Chainalysis said the malfunction inadvertently delayed laundering connected to the Binance theft.

Exchanges Face Pressure to Block Cash-Out Attempts

The Federal Bureau of Investigation (FBI) attributed the Binance theft to North Korea on Oct. 31, identifying the activity as Tradertraitor, a North Korean state-sponsored hacking group. Working with the U.S. Secret Service and IRS Criminal Investigation, it observed conversions primarily into ether. Authorities urged exchanges, infrastructure operators, and decentralized finance services to block transactions involving the listed addresses.

Intervention depends partly on the assets involved. Stablecoin freeze and blacklist controls allow issuers to prevent designated addresses from transferring tokens even when holders control their wallet keys. Exchanges can separately restrict deposits or freeze accounts, providing another intervention point for cryptocurrencies without issuer-controlled freezes.

Elliptic’s chart traces the stolen assets from their original form on Oct. 29 through swaps, freezes, and remaining holdings as of Nov. 2. It shows $2.85 billion frozen, while the attacker retained approximately $1.43 billion in bitcoin across 40 addresses and $1.37 billion in ether across 857 addresses. A separate $16 million flowed into addresses containing Bitget-exploit proceeds, indicating that some funds from the two thefts were combined.

Distribution of assets stolen from Binance. Band widths reflect values at the time of theft; right-side labels show estimated values around 07:00 UTC on Nov. 2. Source: Elliptic.

Changing one cryptocurrency into another does not itself establish a cash-out. Elliptic estimated that approximately $3.24 billion remained in theft-linked addresses at that observation time, mostly in ether and bitcoin. It expected eventual cash-out attempts through over-the-counter brokers over several months.