Blockchain analytics firm Elliptic said the Binance hacker used about 12,000 wallets across 11 blockchains and sent more than 40,000 transactions in less than four days to launder funds, describing the process as clearly automated.
According to Elliptic, $2.85 billion of the $6.43 billion stolen has been frozen or seized, or about 44%. Another $3.24 billion remains in addresses linked to the theft, mainly in ETH and BTC, and only a very small amount may have been converted into cash so far.
Tron emerges as the main route
Elliptic said Tron is currently the main channel in the laundering path. Funds were first dispersed to about 7,700 addresses and then bridged to Ethereum, with at least $147 million moved out through that route.
ETH, SOL, NEAR and XRP started moving on Nov. 1
The firm said ETH, SOL, NEAR and XRP began moving on Nov. 1. Among them, 233 million XRP was transferred in full to six new addresses on Nov. 2.
The 18,270 BTC stolen by the hacker was split into 19 addresses on the day of the incident and has not moved since.
First use of CoinJoin identified
Elliptic also said about 28 BTC, worth about $2.2 million, has entered CoinJoin mixing transactions used by wallets including Wasabi. It marked the first time the stolen funds had been sent through a mixer.
Another roughly $16 million was transferred to addresses that also hold funds tied to the Bitget theft in September.
Elliptic's view on the next steps
Elliptic said it expects the hacker, following the pattern seen in the Bybit theft, to convert ETH into BTC in multiple transactions and then cash out over several months through OTC brokers and exchanges.
