Elliptic traces $2.2M of Binance hack funds through Bitcoin mixing

What it is

Elliptic's 2 November 2026 analysis of the 29 October 2026 Binance hack found about 28 BTC (roughly $2.2 million) entering Wasabi-style coinjoins. This is the first mixing of the stolen proceeds it has detected. Mixing began on 1 November, and by 1:02 a.m. ET on 2 November Elliptic had counted 18 coinjoin transactions. The FBI attributed the theft to North Korea's TraderTraitor activity on 31 October.

How it works

The coinjoins use WabiSabi, the protocol behind Wasabi Wallet. Coinjoins pool bitcoin from several users into one transaction, which makes it harder to link inputs to outputs. The first bitcoin entering the mixers came from funds routed out of Tron. Later bitcoin came from swaps of some ETH the thieves had parked.

Elliptic says the activity is scripted, not AI-directed. It cites regular timing, predetermined amounts and blind retries, and described it as "running on conventional automation".

Scale and balances

• Elliptic is tracking about 12,000 wallets on 11 blockchains and more than 40,000 transactions, all within four days of the theft.
• The theft was worth $6.43 billion at prices on the day of the hack.
• About $3.24 billion remains in linked addresses, mostly ETH and BTC. A further $2.85 billion is frozen or seized. Both figures use prices from around 2 a.m. ET on 2 November, so they are not directly comparable with the theft figure.
• The 18,270 BTC stolen directly sit on 19 addresses and had not moved.

What to do

• The FBI asked cryptocurrency businesses and infrastructure operators to block transactions involving its listed addresses, or funds originating from them. Those addresses are in the FBI notice, not in this page.
• Elliptic names two remaining chokepoints. One is stablecoins held briefly mid-transfer, because issuers can freeze tokens. The other is centralized cashout platforms. Native BTC and ETH are outside issuer freezing powers.
• The US Secret Service said on 30 October that it is working with private-sector partners and the US Attorney's Office for the District of Columbia to identify, freeze, trace and recover the funds.

Caveats

Elliptic believes only a tiny fraction of the funds has been converted to cash so far. The page lists no addresses, transaction IDs or tracing method, and every figure is Elliptic's own. The article states it was produced with AI assistance and reviewed by editors.