Hackers laundered $242 million in two days after the Binance crypto exchange hack. The attack occurred on October 29: about $6.36 billion was withdrawn from the exchange across ten blockchains. $2.85 billion was recovered or frozen, which is 44% of the amount.
The rest is with the attackers. $3.24 billion sits in more than 950 wallets, and part of the money has already passed through mixers. A mixer is a service that mixes coins from different users to break the transaction trail.
Why this matters to a trader. Large remaining balances of stolen BTC and ETH have not yet been touched. If they start being sold, pressure on the prices of the two main cryptocurrencies will increase.
How many wallets and networks
The scale was calculated independently by different parties. Analysts' estimates diverged, but the order of magnitude is the same.
- Elliptic - about 12,000 wallets across 11 networks. Elliptic is a blockchain analytics company.
- SomaXBT - 12,137 addresses and over 56,000 transactions.
- Tron - $628 million was stolen here: 612.7 million USDT and 46.4 million TRX.
- Tether - froze 378.7 million USDT on the very first day, leaving the attackers with about $249 million.
Where the money went
The main flow went through bridges - about $194 million. A bridge is a service for transferring assets between blockchains.
- $26 million remained inside Tron. It is held in the JustLend lending protocol, in swaps for the USDD stablecoin, and in accounts at the HitBTC and Gate exchanges.
- $22 million was lost to fees and slippage. This is the price of haste during withdrawal.
- THORChain became the main channel. 185.1 million TRX and 3.83 million USDT in 2,697 transfers were converted into 17,019 ETH across 170 addresses and 53.25 BTC. 12%, or $5.7 million, was lost in the exchange.
Who is behind this
The FBI attributed the attack to the North Korean group TraderTraitor. The money was run through about 20 automated services in less than three days. Six bridges were used for the first time within a single 100-minute window on October 30.
Tom Robinson, co-founder and chief scientist at Elliptic: "the laundering is automated, but nothing seen suggests an AI agent is making the decisions". The scheme resembles scripts supervised by humans.
What happens next
The large balances are barely moving. Among them are roughly 53,300 ETH. While the coins sit still, token issuers and exchanges have time to block the addresses.
- Risk for the market - a sell-off of the stolen BTC and ETH will increase pressure on prices.
- What to do - check the available coins and the rules for transferring positions, and choose a challenge for your market in advance.
What this means for a trader
The move will come without warning. Events like this are not in the economic calendar, and you will have to react as they happen.
Holding BTC while $3.24 billion hangs in the air?
Stories like this move crypto in bursts - at night, on weekends, and without a single line in the calendar. If your trading nominal is provided by a prop firm, what decides is not your chart analysis but its rulebook. Which coins are available, whether a position can be held overnight, whether drawdown on an open trade counts. One wording in the rules determines whether the account stays active or not. Filtering programs by your instruments and style is easier to do in advance than to find out during the review of a single trade.