INTEL: Binance hacker mixes stolen funds for first time, 28 BTC via CoinJoin, Elliptic says

The Binance hacker has begun mixing stolen funds, with about 28 BTC (roughly $2.2 million) run through Wasabi-style CoinJoin transactions, blockchain analytics firm Elliptic said. It is the first mixing seen in the laundering so far. Elliptic puts the total stolen at about $6.43 billion, of which about $2.85 billion has been frozen or seized.

According to Elliptic, the laundering has used about 12,000 wallets on 11 blockchains and more than 40,000 transactions in under four days. The firm describes the process as conventional automation. About $3.24 billion still sits in addresses linked to the theft, mostly ETH and BTC, and Elliptic says only a very small amount may have been cashed out so far. The frozen share is about 44% of the total.

Tron route and other movements

Tron is currently the main channel. Funds were spread across about 7,700 addresses and then moved to Ethereum through cross-chain bridges, at least $147 million in total, Elliptic said. Since November 1, ETH, SOL, NEAR and XRP have also started moving. On November 2, 233 million XRP went in full to six new addresses.

The 18,270 BTC taken in the hack was split across 19 addresses on the day of the theft and has not moved since, per Elliptic. About $16 million was sent to addresses that also hold funds from the September Bitget hack.

Separately, Arkham data showed the hacker sent about $4 million to three Binance deposit addresses. Arkham said these may belong to nested services, third-party exchanges that use Binance for liquidity and custody, so the transfers do not necessarily mean deposits to the Binance exchange itself.

Elliptic expects the hacker to follow the pattern seen in the Bybit theft: swapping ETH for BTC in several batches, then cashing out through over-the-counter brokers and exchanges over a period of months.