Elliptic traces Binance hack proceeds through bitcoin mixing and 12,000 wallets

Following the record $6.3 billion Binance heist on October 29, 2026, attributed to North Korea's TraderTraitor group, blockchain analytics firm Elliptic revealed that attackers moved stolen assets through roughly 12,000 wallets across 11 blockchains, utilizing automated scripts, TRON routes, and CoinJoin Bitcoin mixing. While crypto issuers froze $2.85 billion in stablecoins and Binance covered 95% of stolen funds, customers withdrew a net $3.64 billion upon platform reopening.

Elliptic findings on laundering methods

• ▪Elliptic determined that regular time intervals and fixed transfer amounts in the Binance hack laundering were driven by conventional automation scripts rather than artificial intelligence software.
• ▪Elliptic reported on November 2, 2026 that stolen Binance assets were laundered across roughly 12,000 wallets and over 40,000 transactions spanning 11 blockchains, averaging one new wallet every 25 seconds.
• ▪Attackers used lending vaults to deposit crypto assets from one address and withdraw to others without direct wallet transfers, alongside Thorchain cross-chain swaps.

Bitcoin mixing and unmoved funds

• ▪Between November 1 and early November 2, 2026, hackers passed roughly 28 Bitcoin worth $2.2 million through 18 CoinJoin privacy transactions using the WabiSabi protocol.
• ▪The 18,270 Bitcoin stolen directly from Binance remained unmoved in 19 addresses, while the Bitcoin mixed through CoinJoin came from assets converted after the October 29, 2026 theft.

Laundering of funds on TRON

• ▪Over a 51-hour period ending November 1, 2026 at 05:33 UTC, approximately $147 million left the TRON network via 1,113 transfers, primarily migrating to Ethereum as ETH.
• ▪Attackers initially swapped 234 million stolen USDT for TRX on SunSwap, using approximately 7,700 TRON network addresses before moving funds off TRON.

Freezing of stolen crypto assets

• ▪Stablecoins accounted for 94% of the restricted Binance hack funds, while native cryptocurrencies on Bitcoin, XRP Ledger, Solana, and NEAR could not be frozen by issuers.
• ▪Crypto issuers and network governance mechanisms froze approximately $2.85 billion of the stolen Binance assets by November 2, 2026, representing about 44% of the total stolen funds.

Binance coverage of stolen assets

• ▪On October 31, 2026, Binance reported that its digital asset replenishment following the hack had reached approximately 90%.
• ▪Binance secured digital assets to cover approximately 95% of the stolen $6.3 billion using its corporate treasury, Futures Insurance Fund, and emergency reserve funds.

Binance post-reopening withdrawal outflows

• ▪The $3.64 billion net withdrawal outflow on November 1, 2026 represented just over 2% of the $171 billion in total assets under management at Binance.
• ▪Following the exchange reopening on November 1, 2026, Binance processed $4.649 billion in withdrawals and $1.01 billion in deposits between 06:00 and 15:30 GMT, resulting in a net outflow of $3.64 billion.