Binance Hackers Move Stolen Crypto Through 800+ Wallets: Can the FBI Stop the $3.25B Laundering Trail?
Share
Key Takeaways
Blockchain investigators have traced stolen Binance assets through approximately 12,000 wallets across 11 blockchains, including more than 800 Ethereum addresses used to distribute funds.
Around $2.85 billion of the reported $6.43 billion theft has been frozen or seized, while approximately $3.18 billion remains in addresses linked to the attack as of Nov. 3.
The FBI has attributed the theft to North Korea’s TraderTraitor operation, but preventing the remaining funds from being converted into spendable money presents a different challenge.
The hackers behind Binance’s multibillion-dollar security breach are moving stolen cryptocurrency through thousands of wallets, decentralized exchanges and cross-chain bridges, testing how effectively law enforcement can follow illicit funds across an increasingly fragmented blockchain ecosystem.
An updated Nov. 3 investigation by blockchain analytics firm Elliptic identified more than 40,000 transactions involving approximately 12,000 wallets during the first three and a half days following the Oct. 29 attack.
Binance hack update: the laundering is running on conventional automation, with about 12,000 wallets on 11 blockchains and more than 40,000 transactions in under four days.
➡️ $3.24 billion still sits in linked addresses, mostly ETH and BTC ➡️ $2.85 billion has been frozen ➡️…
Although roughly $2.85 billion has already been frozen or seized, investigators estimate that another $3.18 billion remains in accounts associated with the theft.
That leaves a central question for the FBI and cryptocurrency exchanges: can identifying the perpetrators and tracking their wallets actually prevent the stolen assets from entering the financial system?
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
The attackers’ immediate challenge was not simply moving the cryptocurrency. It was preventing assets from being frozen before they could be converted.
Approximately $3.46 billion of the stolen funds consisted of stablecoins, including USDT and USDC. Unlike Bitcoin and Ethereum, these tokens can be frozen by their issuers under certain circumstances.
That created a race between the attackers, token issuers, and investigators.
Circle reportedly froze all 823 million stolen USDC before the attackers could exchange it.
Elliptic estimates that approximately $786 million in stablecoins escaped conversion restrictions, while the wider freezing and seizure response secured $2.85 billion.
Once the immediately vulnerable stablecoin balances had been addressed, the operation shifted toward dispersing assets across numerous wallets.
Tron became a major distribution network.
Approximately 684.6 million TRX was routed through a distribution wallet before being divided among roughly 7,700 addresses. At its busiest, the network recorded around 1,300 transactions linked to the operation in a single hour.
Binance laundering final 5 tron wallet by hour. | Source: Elliptic
The attackers also used multiple cross-chain bridges to transfer value from Tron to Ethereum. At least $147 million was bridged out of Tron, with much of it ultimately arriving as ETH.
By Nov. 3, approximately 68,600 ETH was distributed across roughly 840 smaller Ethereum addresses, many holding between 10 and 100 ETH. However, the smaller wallets represent only part of the picture.
Nine larger Ethereum addresses reportedly held 89% of the attacker’s ETH, with those balances largely unmoved since Oct. 30.
This creates an unusual situation: the most visible laundering activity involves thousands of transactions, yet substantial amounts of stolen cryptocurrency remain concentrated in relatively few addresses.
The scale of wallet creation can make the investigation appear more complicated than the actual movement of value. A transfer between two addresses controlled by the same attacker does not necessarily indicate a payment, sale, or successful laundering.
The more consequential question is where those funds eventually leave the blockchain ecosystem.
FBI Names North Korea’s TraderTraitor Group, but Can It Stop the Laundering?
The FBI formally attributed the Binance theft to North Korea’s TraderTraitor operation on Oct. 31, two days after the attack.
In its public security alert, the agency said it was working alongside the US Secret Service and IRS Criminal Investigation to track the stolen cryptocurrency.
Investigators identified ETH conversion as an early laundering strategy and warned that the proceeds could subsequently move through decentralized finance platforms and instant exchange services.
The FBI also published cryptocurrency addresses associated with the attackers, urging exchanges, blockchain analytics companies, THORNode operators and other infrastructure providers to prevent transactions involving stolen funds.
However, publishing an address does not automatically immobilize its assets.
Bitcoin and Ethereum transactions generally cannot be reversed or frozen by a central issuer. Unless investigators gain control of the private keys, secure cooperation from a custodian, or intercept assets at a service that can restrict them, the cryptocurrency can continue moving.
This is where the difference between identifying stolen funds and recovering them becomes significant.
The FBI can establish attribution, share intelligence, and coordinate legal action. But preventing laundering requires cooperation from exchanges, token issuers, and other service providers, many operating across different jurisdictions.
The attackers appear to be exploiting those operational gaps.
Elliptic identified transfers through lending vaults, where funds can be deposited from one address and withdrawn to another without a conventional direct wallet-to-wallet transfer.
Some cryptocurrency was also converted into Bitcoin and passed through CoinJoin transactions, which combine multiple users’ inputs and outputs to complicate transaction tracing.
By early Nov. 2, approximately 28 BTC, worth around $2.2 million, had been involved in 18 such transactions.
Although small compared with the overall theft, this activity signals a shift from distributing stolen assets toward making their ownership history harder to reconstruct.
Investigators have also observed movement involving XRP and Solana.
On Nov. 2, approximately 233 million XRP were transferred into six new addresses. By the following morning, around 87,000 SOL, valued at approximately $8 million, had left the original Solana theft wallet.
Binance laundering final 7 XRP and Solana. | Source: Elliptic
Some SOL was routed through lending and liquid-staking services before being converted into Bitcoin.
These developments suggest the attackers are testing several laundering channels rather than relying on a single network.
Importantly, the rapid transaction patterns do not establish that artificial intelligence is directing the operation. Elliptic’s findings are consistent with conventional automated scripts, including repeated transfers, predetermined amounts, and retries after failed transactions.
Why the $1.5B Bybit Hack Offers a Warning for Binance
The FBI has encountered a similar challenge before.
In February 2025, the North Korean hacking group TraderTraitor stole approximately $1.5 billion from Bybit.
The FBI subsequently warned that the stolen assets were being converted into Bitcoin and distributed across thousands of addresses on multiple blockchains.
The pattern resembles the current Binance investigation, although the scale is considerably larger.
According to Elliptic, attackers moved the approximately 499,000 ETH stolen from Bybit through laundering transactions within 10 days. Converting those proceeds into spendable money, however, took substantially longer.
Its subsequent analysis indicated that some Bybit-linked funds eventually reached suspected Chinese over-the-counter cryptocurrency brokers.
Such brokers can create a difficult investigative boundary. Cryptocurrency is sent to an address controlled by an intermediary, while payment to the seller may occur through separate, off-chain arrangements.
The blockchain records the transfer, but not necessarily the identity of the ultimate beneficiary or the corresponding payment.
Elliptic estimates that only around 3% of the Bybit theft was frozen, compared with approximately 44% of the Binance assets. That improvement is substantial, but it does not guarantee the remaining funds will be recovered.
The Binance attackers still control assets that their issuers cannot directly freeze. Elliptic’s Nov. 3 update indicates that around 18,270 stolen BTC remains distributed across 19 addresses, with no subsequent movement detected.
The relative inactivity of those holdings could be significant. Large Bitcoin transfers may attract immediate attention, particularly when their source addresses are already publicly identified.
Instead, the attackers may choose to convert and liquidate smaller amounts over an extended period.
The critical issue is whether exchanges and OTC brokers can recognize stolen funds after multiple swaps, bridges, and wallet transfers.
Elliptic has published a public blocklist to help businesses identify addresses associated with the theft. However, static lists become less effective as new addresses emerge, making continuous transaction monitoring increasingly important.
For the FBI, the investigation is therefore entering a potentially prolonged phase.
The agency has identified the suspected perpetrators, and a significant portion of the stolen cryptocurrency has already been immobilized. Yet investigators must now contend with an operation capable of creating thousands of wallets, crossing blockchains, and changing assets faster than conventional manual investigations can keep up with.
As of Nov. 3, Elliptic believes only a negligible portion of the stolen funds has actually been cashed out.
That leaves an important window for intervention, but not necessarily a short one.
The real test is no longer whether investigators can follow the stolen cryptocurrency. It is whether they can prevent the people controlling it from eventually converting billions in traceable blockchain assets into spendable money.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
Easy 
