Summary
After an attack that reportedly stole about $6.3 billion in crypto assets from Binance users, the funds were split across thousands of wallets, moved between blockchains and partly converted into bitcoin. The case has also brought renewed scrutiny to exchange security, money-laundering responsibilities and the regulatory status of decentralized protocols.
The hack has entered a second phase: moving the money
The reported Binance theft did not end when the exchange temporarily halted withdrawals. The next stage was the rapid movement of the stolen assets. According to reporting cited in the source material, the attackers split the funds among large numbers of wallets, moved them across several blockchains and exchanged some of the assets for bitcoin. The apparent objective was to make the funds harder for exchanges, investigators or other intermediaries to freeze or seize.
TechCrunch reported that approximately $6.3 billion in cryptocurrency was stolen from Binance users. Binance and the Federal Bureau of Investigation attributed the attack to a North Korea-linked group known as TraderTraitor. North Korea has denied carrying out the intrusion. Attribution in a cross-border cybercrime case can involve technical indicators, intelligence assessments and blockchain tracing, but it remains important to distinguish an investigative attribution from a final legal determination.
Binance froze withdrawals for several days. Once withdrawals were restored, users reportedly withdrew a net $3.6 billion during the first few hours. The exchange said it would bear the financial impact of the stolen funds and would not pass those losses on to users. That commitment may address an immediate question about customer exposure, but it does not resolve the broader governance issues raised by the incident: how assets were secured, how abnormal activity was detected and how the exchange managed liquidity and communications during a crisis.
Stolen altcoins converted into bitcoin
Odaily, citing Elliptic co-founder and chief scientist Tom Robinson, reported that the attackers had converted approximately $175 million in stolen altcoins into about 2,300 bitcoin. The funds were said to have moved through 16 blockchains, more than 20,000 wallets and at least 65,000 transactions. Around 88 bitcoin reportedly passed through Wasabi Wallet’s mixing function.
The reported activity illustrates why cross-chain movement has become a central challenge for digital-asset investigations. Moving assets from one blockchain to another can reduce the effectiveness of controls that exist only on the original network. Splitting funds across many intermediate wallets can also complicate attribution and create a larger number of transactions for analysts to examine. Converting less liquid or more easily identified tokens into a widely used asset may provide additional transfer routes, although it does not by itself demonstrate that the funds have been successfully cashed out.
The figures also need to be interpreted carefully. Odaily cited Arkham Intelligence data showing that, at a specified point in time, addresses associated with the attackers held approximately 18,384.725 bitcoin, while the reported additional 2,300 bitcoin was not visible in the same data set. Differences of this kind can result from address-labeling decisions, delays in identifying cross-chain movements, changes in attribution and differences in update frequency. They should not automatically be read as proof that the funds have disappeared or that all of the reported assets have been spent.
Blockchain analysis can create a detailed record of movements, but it does not solve every evidentiary question. Investigators still need to determine which addresses are controlled by the same party, whether an intermediary acted knowingly, and whether a transaction represents a conversion, a temporary routing step or an attempt to conceal ownership. Those distinctions matter both for enforcement and for the institutions responsible for screening incoming and outgoing transactions.
THORChain and Wasabi put decentralized services under the spotlight
TechFlow, summarizing reporting from The Wall Street Journal, cited Chainalysis data indicating that THORChain processed more than $46 million linked to the Binance theft during the first 72 hours. The report said the service collected more than $200,000 in fees from the relevant transactions. During the same period, nearly $4 million reportedly moved through Wasabi Wallet for mixing.
The two services perform different functions. THORChain is designed to facilitate exchanges across blockchains, while Wasabi Wallet includes a feature intended to reduce the visibility of bitcoin fund origins. Their use in the movement of stolen funds does not, on its own, establish that their developers participated in the theft or knowingly laundered criminal proceeds. It does, however, create a difficult regulatory question: what obligations arise when a service continues processing transactions after law-enforcement agencies or blockchain analytics firms have identified the funds as connected to a major theft?
The debate turns on what “decentralized” means in practice. Some protocol developers argue that a smart contract may not contain a mechanism to screen an individual wallet or block a particular transaction. They may also argue that no single operator controls the system and that imposing conventional know-your-customer or suspicious-activity reporting duties on the code is technically and legally inappropriate.
Critics respond that the code is only one part of the service. A protocol may also have a front end, a group of infrastructure operators, upgrade permissions, governance arrangements, key holders and a fee-distribution system. Those elements can create forms of practical control even where the underlying contracts are publicly accessible. If a service can continuously process transactions and generate revenue, regulators may ask whether the people who maintain or benefit from that service have meaningful responsibilities for managing foreseeable illicit-finance risks.
The source material cites former investigators who questioned whether some services described as decentralized are operationally centralized. It also cites a THORChain representative who said the protocol did not have the code necessary to screen individual transactions or wallets. The contrast captures the gap between autonomous code and real-world operation. A system may be difficult to stop at the transaction level while still being influenced by a relatively identifiable set of developers, infrastructure providers or governance participants.
The CFO departure adds a governance dimension
Shortly after the theft, Binance announced that Chief Financial Officer Kaiser Ng was leaving to pursue a new venture. According to the reporting, co-CEO Yi He said that Ng had spent more than five years at Binance and that a transition plan had been implemented over the preceding six months. Justin Yek is expected to succeed him as CFO.
The available material does not establish a direct connection between Ng’s departure and the hack. The personnel change should therefore not be treated as evidence of an internal finding or an allocation of responsibility. Nevertheless, a senior executive transition after a major security event naturally draws attention to financial reporting, loss-absorption arrangements, internal controls and crisis communication.
For institutional wallet users, custodians and other organizations assessing digital-asset infrastructure, those issues can be as important as an account balance. The relevant questions include whether assets are segregated, whether permissions are divided among multiple roles, whether abnormal withdrawals can be stopped quickly, whether address screening extends across chains, and whether a complete audit trail is preserved after an incident. The Binance case illustrates how exchange security and institutional custody risk overlap without being identical: a customer may depend on an exchange’s controls even when the customer’s own wallet policies are sound.
Regulation may focus on operations, not just code
Traditional financial institutions are generally expected to conduct customer identification, monitor transactions and report suspected money laundering. Decentralized-finance services have often been built around non-custodial, permissionless or difficult-to-intervene designs. The legal treatment of those systems remains contested in many jurisdictions.
The Binance theft puts the issue in concrete terms. If illicit funds are visibly moving on public blockchains and a service has been alerted to their suspected origin, can the service continue processing them by arguing that the protocol cannot intervene? Future regulatory and judicial analysis may look beyond whether a smart contract can block a transaction. It may examine who operates the front end, who controls upgrades or emergency keys, who runs the infrastructure, who receives fees and how much influence developers or governance participants exercise in practice.
The source material notes that U.S. prosecutors have previously pursued operators of certain blockchain services, alleging that they knowingly helped process criminal proceeds. Such cases are highly fact-specific, and liability depends on the applicable law, the facts of control and knowledge, and the relevant jurisdiction. The existence of a decentralized protocol does not automatically prove culpability, but neither does the label automatically eliminate questions about human and organizational responsibility.
For exchanges, custodians and institutional wallet providers, the incident also highlights the need for controls that extend beyond a single blockchain. Key management, withdrawal risk controls, cross-chain monitoring, address screening, vendor oversight and incident-response procedures all become relevant when assets can move through multiple networks in minutes. A freeze on one chain may not prevent a transfer through another, and an institution’s ability to reconstruct events depends on accurate logs and clearly defined authority.
There is no final conclusion in the available reports on how much of the stolen money can be recovered, whether the attackers have converted any of it into fiat currency, or whether additional enforcement actions will follow. What is clear is that the incident has turned a technical security failure into a wider question of governance and law. Decentralized design may reduce dependence on a single controlling party, but it does not necessarily remove operational accountability. For institutions evaluating digital-asset infrastructure, transparent permissions, verifiable controls and a clear compliance perimeter are becoming central risk variables.
Source: link