Binance theft: $2.85 billion frozen as hackers use 20,000 wallets
Editorial Team
••📖10 min read
Elliptic estimates that responders froze or seized 44% of the $6.43 billion stolen from Binance. Cross-chain services and screening gaps kept other funds moving, but most remaining value was still parked and little had likely been cashed out.
Elliptic estimates $2.85 billion was frozen or seized, about 44% of the theft it measured.
More than 20,000 wallets were used, but most remaining value was still parked as of November 7.
Cross-chain swaps, lending pools and screening gaps left routes open; cash-out and recovery remain unresolved.
Responders froze or seized an estimated $2.85 billion after the October 29 theft from Binance, one of the world's largest cryptocurrency exchanges. Yet the attackers continued shifting other funds through thousands of wallets after the U.S. Federal Bureau of Investigation (FBI) urged service operators to block them. The result is a substantial intervention with a clear limit: much of the remaining cryptocurrency can be traced, but cannot be frozen by an issuer.
Blockchain intelligence and screening company Elliptic put the restricted share at about 44% of its $6.43 billion theft estimate in its November 7 analysis. It called that unusually high, compared with around 3% frozen after the February 2025 Bybit exchange theft. The composition matters: more than half the Binance haul was in stablecoins, whose issuers can block transfers.
Elliptic estimated that about $3.13 billion remained in theft-linked addresses at 08:00 UTC on November 7, mostly in bitcoin and ether. Most of that value had not yet been laundered, it said, and a negligible amount had likely been cashed out. Wallet proliferation alone therefore overstates how far the attackers have progressed toward turning the haul into spendable money.
Elliptic’s company-reported estimates as of November 7. Frozen or seized funds are not necessarily returned assets; wallet counts do not measure cash-out. Source: Elliptic.
A familiar attacker, a much larger loss
The FBI's October 31 alert attributed the theft of more than $6 billion to North Korea. It calls this malicious cyber activity TraderTraitor. Working with the U.S. Secret Service and IRS Criminal Investigation, the agency urged node operators of THORChain, a protocol for exchanging assets between blockchains, along with instant exchanges, decentralized finance services and other providers to block transactions involving or derived from the listed addresses.
N-able says its latest N-central hotfix patches all identified vulnerabilities exploitable without authentication and hosted servers are back online. Further patches, customer-side upgrades and checks for compromise remain necessary after public exploit code prompted a precautionary shutdown.
Editorial Team
TraderTraitor has a longer record of targeting cryptocurrency businesses. A report describing a 2022 joint U.S. advisory identifies it as North Korean state-sponsored activity dating to at least 2020, intended to steal and launder cryptocurrency to support the regime. The FBI's latest alert did not disclose its attribution evidence. North Korea denied involvement, according to blockchain data provider Bitquery's account.
The FBI had issued a similar blocking appeal in its February 26, 2025 notice attributing the approximately $1.5 billion Bybit theft to TraderTraitor. That notice also described assets converted and dispersed across thousands of addresses. At about $6.3 billion in Bitquery's reconstruction, the Binance loss was roughly four times the Bybit theft's dollar value at the time.
Binance serves millions of people who buy and sell cryptocurrency. It holds customers' coins in wallets it controls, keeping some online in “hot” wallets to fund withdrawals. Bitquery's transaction reconstruction traced the loss to 17 such wallets on nine blockchains between 20:04 and 23:56 UTC on October 29.
In that account, Binance said a compromised engineer's laptop gave the attacker access to its withdrawal service, and that it found no evidence of a wallet private-key leak. Bitquery found valid signatures on every drain. On the busiest Ethereum wallet, signed authorizations let the attacker's code keep running until Binance revoked them after midnight—more than an hour and a half after withdrawals were paused.
Elliptic's account of Binance's explanation describes a longer intrusion: tampered AI coding software in June, fake recruitment interviews in September, and access through an internal AI tool to other engineers' machines and the wallet signing service. That does not establish AI-directed laundering. Elliptic said the later transfers showed fixed timing, repeated amounts and blind retries consistent with conventional scripts, with no evidence of an AI agent making decisions.
Bitquery’s company-reported reconstruction: six of Tether’s 11 freezes on Ethereum and Tron reached emptied wallets. Times are UTC; amounts are millions of USDT. Source: Bitquery.
Stablecoin freezes stopped billions, but lending exposed a limit
Elliptic estimated that $3.46 billion, or 54% of the stolen value it measured, was in stablecoins such as USDT and USDC. Their issuers, Tether and Circle, can freeze tokens at specified addresses. Bitcoin and ether have no equivalent issuer-controlled freeze.
Bitquery separately counted approximately $2.8 billion frozen or rescued. Its nine-chain reconstruction and Elliptic's 11-chain account differ in scope. Bitquery also values the theft at transfer-time prices and later holdings at November 5 prices. These figures cannot be combined into one balance sheet, and subtracting them does not yield a cash-out estimate.
In its freeze audit, Bitquery found that Tether locked about 1.76 billion of the 2.488 billion USDT stolen on Ethereum and Tron, or 71%. But six of its 11 freezes on those networks reached wallets already emptied. Elliptic timed Tether's first Ethereum freeze at 37 minutes after the stolen funds arrived. Circle froze all 823 million stolen USDC in the main Ethereum receiving wallet before any moved. Both issuers acted on the night of the theft, before the October 31 FBI appeal.
Other forms of control mattered too. Binance blacklisted about $75 million of its own staked-ether token, wBETH, according to Bitquery. Arbitrum's Security Council, a group empowered to act for that network in emergencies, moved the attacker's ether and ARB tokens into a locked wallet. These actions restricted access; freezing or securing assets does not itself establish that they have been returned to Binance or customers.
Lending offered an escape from an address-level freeze. Bitquery found that one attacker wallet deposited 60 million USDT into Aave, a decentralized lending protocol, and borrowed approximately $45 million in ether before Tether froze the wallet. The USDT was already in a shared lending pool. Freezing that pool would trap other lenders' money as well, Bitquery explained.
Aave's emergency signers froze lending in 32 assets on its main Ethereum market that night. The market reopened the following afternoon, though USDT there still could not secure a new loan, according to Bitquery. On November 4, a liquidator repaid roughly half the attacker's ether debt and took 24.4 million USDT from the collateral. The attacker retained the borrowed ether: the liquidation did not reverse its earlier withdrawal.
Elliptic’s company-reported reconstruction of Tron-to-Ethereum transfers, October 29–November 1, 2026. Each dot represents many addresses; the diagram is not to scale. Source: Elliptic.
Several services kept the remaining funds moving
Elliptic counted more than 20,000 wallets, at least 65,000 transactions and at least 36 services across 16 blockchains by November 7. The techniques were established ones: splitting funds, swapping assets, crossing blockchains, using lending vaults and mixing coins with other users' funds. Smaller batches also reduce the price impact of swaps.
THORChain had already been used to convert ether stolen from Bybit into bitcoin. It was again a major route, but alternatives mattered. An early tally by on-chain analyst and Security Alliance contributor SomaXBT, reproduced in a report updated November 2, estimated that $194 million had left Tron through bridges and swap services in two days. Relay handled $48 million, THORChain $44 million, Chainflip $32.1 million and Symbiosis $16 million. SomaXBT separately put $41.7 million through Bitget Wallet, with its destination unresolved. The figures describe that analyst's early Tron flows, rather than the whole theft or final cash-out.
THORChain technical co-founder Chad Barraford told the report that its official centralized front end had blocked FBI-listed addresses. He said he had not seen discussion of the FBI request among node operators and assumed they would resume normal trading. His statement about the interface did not establish a protocol-wide block.
A technical fault temporarily halted most THORChain swaps on October 31. The interruption was separate from the blocking appeal. Elliptic found that the attacker switched to other bridges during the outage. Both tracing firms describe renewed conversions after swaps resumed on November 3.
Screening at alternatives was incomplete. Relay said it screened addresses with third-party risk data and an internal blocklist, yet analysts traced stolen funds through it. Chainflip had planned an upgrade after the Bybit hack to block those attackers. In its statement to the report, it said rejected Binance-linked deposits were refunded to fresh addresses that its analytics providers had not flagged. Some passed screening when resubmitted. The company said immediate tagging of refund addresses had closed the workaround. Symbiosis also acknowledged gaps in screening fast-moving funds and said it was addressing them.
Mixing created a different obstacle by breaking the visible link between deposits and withdrawals. In its tracing analysis, Elliptic traced bitcoin through Wasabi-style coinjoins, which combine multiple users' coins, and ether and Solana's SOL through the Privacy Cash pool. Privacy Cash describes itself as compliance-focused and says it uses risk screening, according to Elliptic’s account. It temporarily paused deposits on November 4 while strengthening screening. Withdrawals stayed open, and Solana deposits resumed the next afternoon. The service's Ethereum contracts can be paused or upgraded by an administrator wallet.
There was money to be made from the transfers. The November 7 account relayed the Journal’s reporting of findings by blockchain analytics firm Chainalysis that more than $46 million passed through THORChain in the first 72 hours, generating more than $200,000 in operator fees. It separately cited Bitquery's approximately $113 million THORChain trace over another period and methodology. Those volumes cannot be added.
Bitquery estimated that rushed swaps cost the attacker $119 million against market prices, with traders on the other side retaining $60 million after costs. Those are trading losses and counterparty gains, distinct from protocol fees. They show the price of escaping freezes, without establishing that recipients knowingly assisted the theft.
Cash-out, customer backing and recovery are separate tests
Elliptic said the original bitcoin holdings and ether in the nine largest addresses remained stationary. All of the stolen SOL, about $90 million in its account, had been swapped, bridged or mixed, and roughly $100 million of XRP had been swapped, mostly into bitcoin. Across assets, about $175 million had been converted into roughly 2,300 bitcoin in new addresses by November 7.
The earlier November 7 report described Bitquery's separate estimate of $333 million laundered or moved toward cash-out services in the first week. That broader category is not a measure of confirmed cash-out. Nor are the tracing firms' wallet labels proof of who currently controls each address. Elliptic said funds being laundered might already have passed to intermediaries, including Chinese money-laundering networks used in earlier North Korean cases. Elliptic sells screening services, and Bitquery sells blockchain data; their attributed estimates are not a reconciled recovery accounting.
For customers, Binance's own backing of the loss is a separate question. In Bitquery's account, the exchange said it would cover losses from its SAFU emergency fund and its own resources, and later said it had covered about 95%. Deposits continued, Binance said, and withdrawals reopened in stages three days after the theft. Replacing stolen assets on the exchange's books does not recover the original coins. Binance has also promised a full report on what went wrong.
Elliptic expects the remaining ether to be converted into bitcoin in small transactions, followed by attempts to cash out through over-the-counter brokers and exchanges over months, drawing on the Bybit precedent. That is a forecast. The next evidence needed is whether the large parked holdings move, whether screening follows them through fresh addresses, and whether funds can be stopped at cash-out counterparties. A fuller Binance incident report and an accounting of assets actually returned would also distinguish repaired customer backing from recovery of the theft proceeds.
Vates has patched an exploited Xen Orchestra login bypass, while its November 10 advisory leaves a separate VM import flaw unfixed. Administrators must also review delegated permissions and investigate possible host compromise.
CISA has listed exploited flaws in Openwave’s webmail document converter and Cisco’s BroadWorks communications platform, setting a November 24 federal remediation deadline. Openwave dates its fix to 2021; a separate research account links Cisco’s flaw to theft of telecom authentication keys.
Maersk confirms data theft from an acquired legacy system and disputes WhiteArmor’s password claims. The group demands $5 million while Maersk says it has found no impact on wider systems and expects no customer disruption.
Binance warns that malicious iPhone apps could use worse_query to read other apps’ files. A file manager built on the public code demonstrates cross-app access, but no cryptocurrency losses have been confirmed and the latest Apple updates have not been linked conclusively to a fix.
Microsoft fixed an actively exploited Outlook flaw that can disclose authentication information when a user opens a malicious file. The moderate-rated bug warrants priority within a November release exceeding 1,000 vulnerabilities, but the attackers and scale of abuse remain undisclosed.
Vanderbilt University allowed students and employees to resume using university devices Tuesday after ordering a shutdown Monday. Key services were available, but wider restrictions persisted and attackers’ claims of extensive data theft remained unconfirmed.
Barracuda says exploitation of recently disclosed vulnerabilities has affected a small number of organizations. Patches are available, and the two-flaw chain can give attackers root access to Email Security Gateway appliances with reachable administrative interfaces.
SAP’s November release addresses four flaws rated 10.0, including ICM2SHELL and PROXYGATE. Customers face unauthenticated routes into core business systems, and Gateway remediation can require configuration changes alongside patches.
Compromised Qubole credentials let an attacker assume customer AWS roles, harvest secrets and download data in October. Dormant integrations extended the exposure, while gaps in storage logs complicated efforts to establish what was stolen.
Google has fixed an actively exploited XML vulnerability in its Chrome desktop browser. The update brings this year’s exploited zero-day tally to eight, while details of the attacks remain undisclosed.
N-able took hosted N-central offline and urged customers running their own servers to do the same after public exploit disclosures. The shutdown interrupts a platform used to manage customer networks, while the scope of the flaws and a safe restoration date remain unresolved.
Trump nominated Palantir security chief Michael LoSapio to lead CISA, where workforce losses and a proposed funding reduction complicate the job as Senate control is set to change.
Iris Plaza says an intrusion into an external cloud service may have exposed data on 5.8 million current and former members and 1.9 million non-members. Its official shopping site remains suspended, while the actual extent of any leak is still under investigation.
France attributes October attacks on roughly 700 retail sites to an Iranian Revolutionary Guard cyber unit. Fires and spoiled food have turned exposed refrigeration controls into a diplomatic and criminal case, while responsibility for later attacks remains unresolved.
Apple says three macOS updates stop bundled command-line tools from accepting compromised eMudhra certificates, extending protections already delivered to Safari and Mail. Apps with their own certificate lists still require separate checks.
Researchers observed public proxy traffic exiting six addresses registered to the Executive Office of the President. The findings expose a possible route for outsiders to borrow government network identities, but do not establish access to internal systems.
Alpine Linux has patched a password-authentication bypass reachable through OpenSSH on systems using musl without PAM authentication. Under specific account and server settings, attackers can enter key-only accounts; some cloud instances can then give them root access.
Sekoia uncovered mobile data-theft tools delivered through compromised websites, cloned portals and Plerdy's analytics tracker. The analyzed attacks used already-patched flaws, and the report does not establish how many phones were infected.
Ryan James Roach has been extradited to face charges over alleged intrusions targeting US universities with supercomputers. Prosecutors allege credential theft and the diversion of university processing power for cryptocurrency mining; a second defendant remains in Canadian extradition proceedings.
