Binance hackers spread stolen funds across more than 20,000 wallets as Tron and THORChain become key routes

The attackers behind the $6.3 billion theft from Binance have spread the stolen funds across more than 20,000 wallets on 16 blockchains, with Tron and the cross-chain swap protocol THORChain among the main routes, blockchain analytics firm Elliptic said in an analysis last updated at 08:00 UTC on November 7.

Where the money went

Elliptic's tracing shows a deliberate spread across networks:

• Tron: the main route so far, with about $230 million laundered in TRX, according to Elliptic. At least $147 million has been bridged out of Tron. An on-chain analyst, SomaXBT, estimated that about $242 million passed through Tron in two days, The Block reported.
• THORChain: used to swap stolen XRP and SOL into Bitcoin, Elliptic said.
• Mixing: about 88 BTC, worth about $6.7 million, went through CoinJoin transactions by November 7, according to Elliptic.
• Ether: of the $1.34 billion in ether that was stolen, only about $3 million had moved, Elliptic said.

The 18,270 BTC taken in the theft were split across 19 addresses and had not moved by November 7, Elliptic said. In all, about $3.13 billion remained in addresses linked to the theft, mostly in ether and Bitcoin.

The THORChain question

THORChain is a cross-chain swap protocol that Elliptic describes as one of the bridges the attacker used. The FBI urged THORChain node operators and other services to block transactions tied to the theft and published 608 Ethereum, 19 Bitcoin, and one Solana address, according to The Block, BleepingComputer and Elliptic. The list contained no Tron addresses, The Block noted.

THORChain co-founder Chad Barraford told The Block that "the official thorchain centralized frontend has blocked the addresses requested by the FBI." He did not say node operators would block them, and said he expected them to "resume trading as normal." THORChain had halted swaps on October 31 after what Elliptic described as a technical fault; Chainalysis linked the pause to a double refund after an Ethereum block reorganization, The Block reported.

What has not happened yet

"A negligible amount has likely been cashed out," Elliptic said. It added that the funds that have not moved are very likely still held by North Korea, and that on-chain data cannot show whether funds already being laundered have been handed to Chinese money-laundering networks. Elliptic noted that its account may not be complete.

Why it matters

The pace of laundering decides how much of the haul can still be stopped. With $2.85 billion already immobilized, mostly through stablecoin freezes, and much of the rest still in wallets that analysts watch, compliance teams, in our assessment, still have time to act on the FBI's list of addresses.

What it could mean for traders

Large balances controlled by the attackers, such as the 18,270 stolen BTC that Elliptic says have not moved, are a potential source of selling if they reach markets. Analysts track these wallets on-chain, and large movements tend to draw attention quickly. How fast these balances move, and through which venues, is the indicator to follow.