The Binance hacker has begun mixing stolen funds through CoinJoin, moving roughly $2.2 million in Bitcoin through privacy transactions following the exchange’s multibillion-dollar theft.
Summary
- Around 28 BTC entered 18 CoinJoin transactions between Nov. 1 and early Nov. 2.
- Theft-linked addresses still held $3.24 billion, mainly in Ethereum and Bitcoin, according to Elliptic.
- Investigators previously identified $2.85 billion in frozen or seized assets, roughly 44% of the theft.
- Binance has committed company funds to replace stolen assets while investigators follow the laundering routes.
Elliptic’s Nov. 2 report traced the first mixing to 05:55 UTC on Nov. 1. Bitcoin obtained from stolen Tron funds entered transactions using WabiSabi, the protocol used by Wasabi Wallet and similar wallets. Later, some ETH was converted into Bitcoin and followed the same route.
By 06:02 UTC on Nov. 2, the firm counted 28 BTC passing through 18 CoinJoins. Its investigation covered approximately 12,000 wallets, 11 blockchains and more than 40,000 transactions.
Binance hacker begins mixing converted funds
According to the report, the 18,270 BTC stolen directly from Binance remained in 19 addresses without further movement. The Bitcoin entering CoinJoin came from assets converted after the theft.
CoinJoin pools multiple participants’ Bitcoin into shared transactions, making the connection between incoming and outgoing coins harder to follow, the researchers explained.
The firm estimated that a negligible amount had likely been cashed out. Its $3.24 billion linked-address balance therefore describes assets still visible on public blockchains, without establishing who currently controls every wallet.
Frozen assets account for roughly 44% of the theft
In its earlier investigation, Elliptic valued the Oct. 29 theft at $6.43 billion, compared with Binance’s initial estimate of approximately $6.3 billion.
Using the firm’s figures, $2.85 billion divided by $6.43 billion equals approximately 44.3%. The frozen or seized amount and the remaining tracked balance describe separate categories.
Stablecoins represented 94% of the restricted funds, according to that investigation. Tether, Circle and other token issuers intervened, while Arbitrum and Optimism used their governance mechanisms to secure affected assets.
The researchers distinguished native cryptocurrencies from issuer-controlled tokens: Ripple could freeze RLUSD, for example, but could not freeze XRP. Nothing stolen on Bitcoin, the XRP Ledger, Solana or NEAR had been frozen in that assessment.
The same investigation recorded the FBI’s attribution of the theft to North Korea’s TraderTraitor group. Elliptic had previously identified the group as the likely perpetrator.
On Ethereum, the firm traced the largest losses to $3.8 billion across 186 tokens. Four asset categories accounted for 74% of the total theft: Ethereum-based USDT, Bitcoin, USDC, and Tron-based USDT.
Earlier Tron transfers showed repeated automated patterns
Before the CoinJoin activity, an Oct. 31 analysis documented a distribution wallet sending funds every hour for 31 consecutive hours, without an overnight break.
The receiving wallets typically forwarded funds within approximately two minutes, the analysis found. Repeated swap amounts and transfers spaced at regular intervals led the researchers to assess that software was driving the activity.
When a bridge rejected deposits, funds were resent toward the same destination from newly created wallets, according to the findings.
The firm’s late Oct. 31 update put transfers out of the main Tron distribution wallet at approximately $196 million, spread across roughly 200 wallets. It recorded overnight transfer rates of $7 million to $11 million an hour.
For services screening incoming funds, the firm recommended continuous monitoring because addresses could receive theft-linked assets after passing an earlier check.
Binance uses its own funds to replace stolen tokens
Binance’s replacement purchases run separately from attempts to recover stolen assets. As previously reported, the exchange allocated more than $6.34 billion in company funds, with $5 billion already held in matching cryptocurrencies at the time of its second recovery update.
In an Oct. 31 announcement, Binance said replenishment had reached approximately 90%. It identified the Secure Asset Fund for Users, part of its Futures Insurance Fund, and company funds as financing sources.
The exchange said the remaining purchases involved tokens outside its ten largest replenished assets. Lower liquidity could make acquiring the required quantities take longer, according to the announcement.
Binance said its Futures Insurance Fund was excluded from Proof of Reserves because the fund belonged to the company. Users’ reserve checks cover the assets backing their own platform balances.
