Where Did the Binance Hack Money Go? How Stolen Crypto Is Laundered and How Much Comes Back

Short answer: five days after the October 29, 2026 hack, the $6.43 billion taken from Binance hot wallets has split into three parts. About $2.85 billion (44%) is frozen or seized, almost all of it stablecoins whose issuers can block tokens. About $3.24 billion still sits on addresses controlled by the attackers, mostly ETH and BTC, and most of it has not moved yet: by our check of the FBI's address list on November 3, not one of the 18,270 stolen bitcoins has been spent. The rest, roughly $0.34 billion, went out through Tron, cross-chain bridges and THORChain, or was lost on rushed swaps. Analysts at Elliptic say only a negligible amount has been cashed out so far.

History is less kind than these first days. After earlier North Korea-linked hacks, between 0% and 6% of the stolen money was ever frozen or recovered. Binance is the exception because more than half of what was taken was in freezable stablecoins. Binance users are a separate question: the exchange says it has covered 95% of the loss from its own money and that users will not bear it.

This article is current as of November 3, 2026, 10:00 UTC. It continues our report Binance Hack, October 2026: What Happened and What It Did to Crypto Futures. Figures in a case this fresh change daily, so each one says who reported it.

Where is the stolen Binance money now?

Elliptic, a blockchain analytics firm, counts $6.43 billion stolen across 11 blockchains between 20:05 and 23:56 UTC on October 29 (Elliptic, Nov 2). Binance's own estimate is about $6.3 billion; TRM Labs counts $6.36 billion on 10 chains. As of November 2, Elliptic splits the money like this:

• $2.85 billion is frozen or seized. Stablecoins make up 94% of it.
• About $3.24 billion is on addresses linked to the attackers, mostly ETH and BTC, valued at November 2 prices.
• The remaining ~$0.34 billion is what has moved on through laundering routes, plus losses on swaps the attacker made at bad prices and the change in token prices since the theft. This part is not "cashed out": Elliptic says only "a negligible amount" has likely reached cash so far.

We checked the attacker's balances ourselves on November 3, using the 628 addresses the FBI published on October 31 (608 on Ethereum, 19 on Bitcoin, 1 on Solana):

• Bitcoin: 18,270.2 BTC on 19 addresses, nothing spent. Seventeen addresses hold about 1,000 BTC each. These coins have not moved since the first half hour of the theft. At $77,030 per BTC that is about $1.41 billion.
• Ethereum: 551,612 ETH on the 608 FBI addresses, about $1.25 billion. The nine largest addresses hold 93% of it and, according to Elliptic, have not moved since October 30.
• XRP: all 233 million XRP, about $0.29 billion, moved to six new addresses on November 2 and has stayed there since.

That adds up to about $2.95 billion. Elliptic's $3.24 billion is wider: it also counts SOL, NEAR and addresses outside the FBI list.

How much of the stolen money has been frozen?

$2.85 billion, or 44%, by Elliptic's verified count; Binance says about $3 billion. That is a lot for a crypto hack, and the reason is the mix of assets. Of the $6.43 billion, $3.46 billion (54%) was in stablecoins such as USDT and USDC, and their issuers can freeze tokens at any address.

They moved fast:

• Tether froze the attacker's main Ethereum wallet 37 minutes after the USDT arrived, 1.18 billion USDT, and four more addresses within the next 17 minutes.
• Circle froze all 823 million stolen USDC three minutes later, before the attacker could swap any of it. On November 1 Circle said it had frozen more than $1.1 billion of USDC linked to the incident (CNBC); it has not explained where the extra amount came from.
• Ripple (RLUSD), World Liberty Financial (USD1), Paxos, First Digital and the issuers of smaller tokens froze their tokens too. Binance froze its own wrapped ETH.
• Two blockchains took the attacker's tokens away by governance vote: the Arbitrum Security Council seized about $30 million in ETH and ARB, and Optimism governance about 44 million OP (~$5 million) on October 31.

Nothing has been frozen on Bitcoin, the XRP Ledger, Solana or NEAR. As Elliptic puts it, Ripple can freeze RLUSD, but not XRP. Native coins such as BTC, ETH and XRP have no issuer who can block them, which is why the attacker's first goal was to swap stablecoins into them.

The race against the freeze

In the minutes before the freezes, the attacker swapped about $786 million of stablecoins (Elliptic):

• 434 million USDT into 160,451 ETH through Uniswap, 1inch and market makers quoting on request, paying 12–26% above the market price for speed;
• 59.9 million USDT deposited on Aave as collateral to borrow 19,762 ETH, which Tether cannot freeze. On November 1 the loan was still open and close to liquidation;
• 234 million USDT into 638 million TRX on SunSwap on Tron;
• about 150 other tokens into ETH on decentralized exchanges, finished by 06:36 UTC on October 30.

Chainalysis gives one example of the price of speed: $325 million of stablecoins turned into $285 million of ETH in about 20 minutes (Chainalysis).

How is the stolen money being laundered?

So far the money has moved mostly through Tron and cross-chain bridges, with a short stop at THORChain. Here is the route, day by day, from Elliptic's live tracking and our own checks (times in UTC):

• October 29, 20:05–23:56. The theft. At 20:24 one transaction moved two-thirds of the Ethereum losses, $2.53 billion. Freezes started about an hour later.
• October 30, from 02:19. After five quiet hours on Tron, a distribution wallet began sending out 684.6 million TRX in small amounts to about 7,700 addresses. Within two and a half hours the first transfers went through six cross-chain bridges, mostly paid out as ETH on Ethereum. At least $147 million has left Tron through bridges. All the AVAX was turned into USDC and moved to Ethereum through Circle's own CCTP bridge.
• October 31. The FBI named North Korea's TraderTraitor group and published the attacker's addresses. Part of the TRX was swapped into USDD, a stablecoin that markets itself as freeze-free, and 128 million TRX went through a lending vault on JustLend: in from one address, out to 16 new ones. By 22:41 UTC the largest exit from the Tron wallets was THORChain, about $31 million, followed by SunSwap ($5.3 million) and Bitget Swap ($1.8 million) (Elliptic).
• November 1. Tron went quiet after 1,113 transfers in 51 hours. The first mixing started: from 05:55, bitcoin bought with swapped funds went into coinjoins using the Wasabi protocol, about 28 BTC ($2.2 million) through 18 rounds by the next morning. These are not the 18,270 stolen bitcoins, which stay put. Half of the SOL moved to a new address; the on-chain tracker Lookonchain reports that about half of the $95.9 million in stolen SOL was swapped into BTC through the Relay bridge.
• November 2. All 233 million XRP moved to six new addresses between 02:12 and 04:00.

Two things stand out. The first is speed and scale: about 12,000 wallets on 11 chains and more than 40,000 transactions in under four days, roughly one new wallet every 25 seconds. On Tron, each dollar was moved about nine times. The Bybit laundering in 2025 ran on a human schedule; this one runs around the clock. Elliptic calls it conventional automation and says that "nothing we have seen shows an AI agent making decisions."

The second is that about $16 million went to addresses that hold money from the September 2026 Bitget hack, one of the links analysts used to tie both cases to the same group.

Why did THORChain stop?

THORChain is a cross-chain swap protocol: it lets anyone swap native BTC for ETH and other coins with no account and no identity check. After the Bybit hack in 2025, 84% of the stolen ETH went to bitcoin through it (Decrypt).

This time it stopped on its own. On October 31 at 11:34 UTC, a one-block reorganization on Ethereum erased a 10 ETH deposit that THORChain had already counted, the protocol refunded it twice, and the safety system paused swaps on 10 chains, including Bitcoin, Ethereum, Solana and Tron (Cointelegraph). When we queried the THORChain API on November 3 at 10:12 UTC, all ten were still halted, about 71 hours in. Chainalysis says the pause "inadvertently delayed" the laundering of a significant amount of funds.

The FBI's alert asks THORChain node operators, instant exchanges and DeFi services by name to block transactions linked to the attacker's addresses. Whether they will is open: THORChain presents itself as neutral infrastructure, and co-founder John-Paul Thorbjornsen, who says he is no longer involved, argued that node operators should not follow the FBI's request.

How does North Korea usually launder stolen crypto?

The FBI attributes the Binance hack to TraderTraitor, the North Korean group it also named for the Bybit hack in 2025 and the DMM Bitcoin hack in 2024 (FBI). North Korea's state media rejected the accusation. TRM Labs counts $12.8 billion stolen by North Korea-linked hackers since 2017, $7.4 billion of it in 2026 (TRM Labs).

Analysts describe the same playbook again and again. TRM Labs lists the steps: fund an operator wallet through Tornado Cash, split the money across fresh wallets, swap and bridge it into bitcoin (after Bybit and KelpDAO mostly through THORChain), run it through mixers, then cash out through over-the-counter brokers, including Chinese-language networks that buy stolen crypto at a discount, often via USDT on Tron.

Chainalysis studied North Korean thefts from 2022 to 2025 and found a cycle of about 45 days in three waves (Chainalysis, Dec 18, 2025):

1. Days 0–5, layering. DeFi protocols and mixers to break the trail.
2. Days 6–10, first integration. Cross-chain bridges, exchanges with weak identity checks, second-tier mixers.
3. Days 20–45, the long tail. Exchanges with no identity checks, Chinese-language guarantee services, instant exchanges and OTC brokers that turn crypto into cash.

North Korean launderers also prefer small amounts: more than 60% of their laundering volume moves in transfers under $500,000, while other hackers move $1–10 million at a time.

On that template the Binance money is at the end of wave 1. The route differs in one way: this time the attacker used lending protocols (Aave, JustLend) and DEX sales heavily, which North Korean groups used less in earlier cases. TRM Labs also calls the route different from Bybit's. The template describes past cases; it does not predict this one. For scale, after Bybit all 499,000 stolen ETH were laundered within 10 days, and cashing out took months through USDT on Tron and Chinese OTC desks.

How much stolen crypto ever comes back?

Very little, when North Korea is involved. Here is what was frozen, seized or recovered from the attackers after the biggest North Korea-linked hacks. This is separate from what victims got back from the exchange or project itself.

Sources: Elliptic; Bybit via Decrypt; The Block; Cointelegraph; Decrypt; FBI. The WazirX and Drift figures come from secondary reports.

Three patterns explain the numbers:

• What gets frozen is stablecoins. Bybit lost mostly ETH, and Elliptic counts about 3% frozen in the first weeks. Binance lost mostly stablecoins and got 44% frozen in hours.
• Native coins almost never come back once they are in North Korean hands. The 18,270 BTC and the ETH still on the attacker's addresses are the part that, on this history, is least likely to return.
• High recovery happens in two other cases, neither of them typical. Either the network itself is willing to freeze funds: Sui validators froze about 73% of the $223 million stolen from Cetus in May 2025, a code exploit not linked to North Korea. Or investigators find the people years later: in 2022 the US Justice Department seized about 94,000 of the 119,754 BTC stolen from Bitfinex in 2016, roughly 78%.

Across all hacks, recovery is low too. Immunefi counted just 0.4% of losses recovered in the first quarter of 2025, the quarter of the Bybit hack, against about 21% a year earlier (Immunefi).

Will Binance get the frozen money back?

Nobody has said yet. Frozen is not the same as returned: the frozen USDT and USDC sit at the attacker's addresses, blocked, and the issuers have not announced whether they will reissue them to Binance. Binance has also not announced a bounty for help in freezing or tracing the funds. Bybit offered 10% of any funds frozen with outside help in 2025.

Binance did not wait. It set aside more than $6.34 billion of company funds and reports the losses covered at 80% on October 30, 90% on October 31 and 95% on November 1. The last 5% is illiquid tokens outside the top ten, according to its announcements (Binance, Nov 1). The money came from three places:

• Half of the SAFU emergency fund. We checked the SAFU address on-chain: it held 15,000 BTC on October 30 and holds 7,500 BTC now. Binance has promised to bring SAFU back to about $1 billion.
• Part of the Futures Insurance Fund, the reserve that absorbs losses from liquidations. Binance says it released only the excess above the required level.
• The corporate treasury.

"These losses will not be passed on to users," Binance said. If the issuers later return the frozen stablecoins, that money goes back to Binance, not to users, who are already covered.

What the hack means for crypto futures traders

Facts from the last five days that matter if you trade perpetual futures:

• Withdrawals stopped for about two and a half days, trading did not. Binance paused withdrawals at about 22:15 UTC on October 29 and reopened the main coins in phase 1 on November 1 at 06:00 UTC, about 56 hours later. Phase 2, dozens more tokens, started on November 3 at 04:00 UTC. Spot and futures kept trading the whole time. A trader hedged across two exchanges could not move margin from Binance to the other side.
• Most users stayed. In the first nine and a half hours after reopening, $4.65 billion was withdrawn and $1.01 billion deposited: a net outflow of $3.64 billion, 2.1% of the $171 billion Binance held in its last pre-hack proof of reserves (The Block). DefiLlama, which tracks exchange wallets, shows Binance assets at $128.1 billion on November 3, against $144.9 billion before the hack; that drop mixes the theft, outflows and price moves.
• The futures insurance fund paid part of the bill. The fund exists to cover losses when liquidations go wrong, before an exchange turns to auto-deleveraging, which closes profitable positions on the other side. Binance says the fund remains above the required level and adds, in its FAQ, that no exchange can completely avoid auto-deleveraging.
• Proof of reserves has limits. Binance published a new snapshot for October 31 and a zero-knowledge proof on November 2 showing its top ten tokens backed at least 1:1. The futures insurance fund is not part of proof of reserves, and a snapshot is not a full audit.
• The market reaction was short. Liquidations reached $1.53–1.55 billion in 24 hours (CoinGlass, via CoinDesk and The Block). On the Binance BTC perpetual, the low was $76,270 during the 18:00 UTC hour on October 30. US spot bitcoin ETFs saw $643.3 million of outflows on Friday, October 30.

What to take from it:

• Keep only working margin on any one exchange. The rest does not need to sit where a hack can freeze it for days. We made the same point about exchanges leaving a country in An Exchange Can Leave in Five Days.
• Watch prices across exchanges. During the hack, the median gap between Binance futures and Bybit and OKX was 0.6 basis points. A gap of several percent on the same coin would be the market saying it doubts withdrawals. The free Binam screener shows Binance, Bybit and OKX on one screen.
• Ignore anyone offering to recover your funds. Big hacks bring fake "recovery services" and "compensation" messages. Binance users have not lost balances; anyone asking for a fee or your login to get money back is a scammer. Read announcements only in the exchange app or on its site opened from your own bookmark.

Did the hack affect Binam traders?

No. Binam, a crypto prop trading firm, runs evaluations on demo accounts with real quotes, on Bybit or on Binance through the CScalp terminal, so during a challenge the money at stake is the challenge fee, not a deposit on the exchange. How the Binance option works is described in Binance Prop Firm Challenge: How to Trade It in CScalp.

Frequently asked questions

Where did the Binance hack money go?

As of November 2, 2026, Elliptic counts $2.85 billion of the $6.43 billion frozen or seized, about $3.24 billion still on addresses linked to the attackers (mostly ETH and BTC), and the rest moved through Tron, cross-chain bridges and THORChain or lost on rushed swaps. Only a negligible amount has likely been cashed out.

Has any of the stolen bitcoin moved?

No. Our check of the 19 Bitcoin addresses published by the FBI on November 3 found 18,270.2 BTC with nothing spent. The 28 BTC that went through coinjoin mixing on November 1–2 were bought with other swapped funds.

How much of the stolen crypto was frozen?

About $2.85 billion, or 44%, by Elliptic's verified count; Binance says about $3 billion. Stablecoins make up 94% of the frozen amount: Tether froze the main wallet 37 minutes after the USDT arrived, and Circle froze all 823 million stolen USDC before it could be swapped. Nothing has been frozen on Bitcoin, the XRP Ledger, Solana or NEAR.

Who hacked Binance?

The FBI attributed the hack on October 31, 2026 to TraderTraitor, a North Korean group, and published 628 addresses linked to it. TRM Labs, Chainalysis and Elliptic reached the same conclusion. North Korea denied it.

Will Binance get the money back?

Not announced. The frozen stablecoins are blocked at the attacker's addresses, and their issuers have not said whether they will reissue them to Binance. On the history of North Korea-linked hacks, the unfrozen BTC and ETH are unlikely to come back: after Bybit, Ronin, Harmony, Atomic Wallet, WazirX and DMM Bitcoin, between 0% and 6% was ever recovered.

Did Binance users lose money?

Binance says no. It reports 95% of the loss covered by November 1 from half of its SAFU fund, part of the futures insurance fund and company money, and says the losses will not be passed on to users. Withdrawals reopened in phases from November 1.

How is stolen crypto laundered?

Typically the attacker swaps freezable tokens into native coins, splits them across thousands of fresh wallets, moves them across chains through bridges and swap services such as THORChain, mixes them, and finally sells them for cash through OTC brokers. Chainalysis finds that North Korean groups take about 45 days for the full cycle.

Can stolen crypto be traced?

Yes, on public blockchains every transfer is visible, which is why analysts can follow the Binance money wallet by wallet. Tracing stops at mixers, at private chains and at the point where crypto is sold for cash off-chain. Tracing is not the same as getting the money back.

Why did THORChain stop working?

A one-block reorganization on Ethereum on October 31 made THORChain refund a deposit twice, and its safety system paused swaps on 10 chains. On November 3 the pause was still in place, which slowed the laundering of the Binance funds.

What is the biggest crypto hack in history?

The Binance hack of October 29, 2026, about $6.3–6.4 billion. The previous record was Bybit in February 2025, about $1.46–1.5 billion.

How we collected the data

Attacker balances: Bitcoin balances of the 19 addresses in the FBI alert of October 31, 2026, from the public mempool.space API (funded minus spent), and Ethereum balances of the 608 Ethereum addresses via a public Ethereum node (eth_getBalance at block 26,333,588), on the morning of November 3, 2026. Values use Binance prices at about 10:10 UTC on November 3: BTC $77,030, ETH $2,265.89, XRP $1.2548. SAFU: balance of the Binance SAFU Bitcoin address on mempool.space. THORChain status: the THORNode inbound addresses endpoint at 10:12 UTC on November 3. Bitcoin low: 1-hour candles of the BTCUSDT perpetual from the Binance futures API.

Everything else comes from Binance's recovery updates, the FBI alert, Elliptic, Chainalysis, TRM Labs and the media sources linked above, as of November 3, 2026. The "frozen" figures are what analysts could verify on-chain; issuers may have frozen more.

Trading crypto futures involves risk. This article is for information only and is not investment or legal advice.