BTC
ETH
SOL
XRP
BNB
TON
DOT
LTC
POL
HBAR
NEAR
ARB
UNIElliptic says Binance hack funds moved through 12,000 wallets in under four days
Blockchain analytics firm Elliptic reports that assets stolen from Binance on 29 Oct passed through about 12,000 wallets on 11 blockchains, with roughly $3.24bn still held in theft-linked addresses on 2 Nov.
Why it matters: The scale and speed of the automated transfers put pressure on exchanges and stablecoin issuers to block cash-out attempts from addresses linked to a theft the FBI attributes to North Korea.
Key points
- Elliptic tracked more than 40,000 transactions after the 29 Oct theft of $6.43bn, averaging about one new wallet every 25 seconds.
- The FBI attributed the theft to North Korea on 31 Oct, naming the state-sponsored group Tradertraitor.
- Elliptic says $2.85bn had been frozen, while the attacker held about $1.43bn in Bitcoin and $1.37bn in ether on 2 Nov.
Funds stolen from Binance moved through roughly 12,000 wallets on 11 blockchains in under four days, according to Elliptic. The blockchain analytics firm said on 2 Nov that it had traced more than 40,000 transactions after the 29 Oct theft of $6.43bn, at a pace of about one new wallet every 25 seconds.
Elliptic described the laundering as highly complex and clearly automated, but found fixed timing, set amounts and blind retries that pointed to ordinary software scripts rather than artificial intelligence. Chainalysis had flagged similar patterns on 30 Oct, including addresses that received exactly 1 TRX for fees before forwarding larger sums. The attacker also used lending vaults to move deposits and withdrawals between addresses, and Bitcoin mixing began on 1 Nov, with about 28 BTC worth $2.2m passing through 18 coinjoins.
Frozen funds and mixing
The FBI attributed the theft to North Korea on 31 Oct, identifying the group as Tradertraitor, and urged exchanges and other services to block transactions tied to the listed addresses. Elliptic's chart showed $2.85bn frozen, with the attacker holding about $1.43bn in Bitcoin across 40 addresses and $1.37bn in ether across 857 addresses. About $3.24bn remained in theft-linked addresses on 2 Nov, mostly in ether and Bitcoin.
Binance co-CEO Richard Teng said in a video shared on 30 Oct that the attack used additional entry points and bypassed approval controls, and that a self-destruct mechanism had destroyed tools and traces. A Thorchain emergency pause after an accounting discrepancy on 31 Oct inadvertently delayed some laundering, Chainalysis said.
Live updates on NewsFeeds:AltcoinsDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)
How this was produced: an AI model wrote this summary of Bitcoin.com News’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.
Not investment advice. Read the risk disclaimer.