Summary
Blockchain monitoring firms say assets linked to the reported Binance hack have been routed through cross-chain channels and converted into roughly 2,300 bitcoin, worth about $175 million at the cited valuation. The activity is testing exchange incident response, asset tracing and coordination across wallets, protocols and jurisdictions.
A reported shift from altcoins into bitcoin
The movement of assets linked to the reported theft of cryptocurrency from Binance users has continued after the initial attack. Citing Elliptic monitoring, Odaily reported that approximately 2,300 bitcoin had moved into new bitcoin addresses by November 7, with a cited value of about $175 million. The analysis indicated that the bitcoin was obtained largely through the conversion of other assets linked to the theft, rather than through a simple transfer from the attackers’ previously identified bitcoin holdings.
The flow is significant because it shows how a large, fragmented pool of assets can be consolidated into a more liquid and widely monitored asset. It does not, however, establish the identity of whoever controls every destination address. Blockchain addresses are pseudonymous, and estimates can change with market prices, attribution decisions and the time at which a data provider captures its records. For that reason, blockchain investigators generally refer to addresses as “linked” or “associated” with an incident unless ownership has been independently established.
Cross-chain conversion complicates the investigation
One of the reported transactions involved approximately 44 million XRP being moved from addresses associated with the incident. Most of that amount was reportedly converted into bitcoin through THORChain, while roughly 148 million XRP remained in related addresses at the time of the report. A separate account attributed to Elliptic’s co-founder and chief scientist said the broader flow had crossed 16 blockchains, more than 20,000 wallets and at least 65,000 transactions.
Cross-chain systems can allow assets on one network to be exchanged for assets on another without routing every transaction through a single centralized exchange. That functionality is relevant to ordinary blockchain infrastructure, but it also creates additional investigative layers when funds are associated with a theft. Analysts must follow not only a token’s movement on its original chain, but also its conversion route, intermediary addresses, liquidity pools or vaults, destination chain and eventual consolidation.
The mention of THORChain in the reported flow does not by itself establish that the protocol, its participants or every service connected to it was involved in the attack. The public information describes a route through which assets were allegedly exchanged. Whether a transaction can be identified, restricted or stopped depends on the design of the protocol, the role of validators or nodes, the policies of interfaces and service providers, and the ability of participants to recognize high-risk funds in time.
CoinJoin adds another layer of uncertainty
Blockchain monitoring also identified bitcoin moving through Wasabi-like CoinJoin transactions. About 88 BTC was reportedly mixed in total, including a batch of approximately 53 BTC that entered such transactions during the cited period. CoinJoin combines inputs and outputs from multiple participants, making it harder for an outside observer to determine which output corresponds to which original input.
CoinJoin is a transaction structure, not automatic proof that every participant is engaged in illegal activity. In the context of a major theft, however, the use of mixing services can become an important risk indicator for exchanges, custodians and compliance teams. It can make straightforward address screening less effective and force investigators to consider transaction timing, amounts, repeated behavior and connections across several networks.
The reported activity illustrates why a single blacklist is unlikely to capture the entire risk. A wallet may receive an asset on one chain, split it across multiple addresses, route it through a cross-chain service, convert it into another asset and later recombine the proceeds. Risk systems therefore need to connect provenance, transaction behavior and cross-chain relationships rather than evaluate each transfer in isolation. At the same time, broad automated restrictions can affect unrelated users, so any intervention requires careful review and a defensible basis.
Dormant balances remain an unresolved risk
Elliptic-related information said that the main bitcoin and ether holdings associated with the attackers had not been moved on a large scale during the relevant monitoring window. Another report citing Arkham Intelligence said the associated addresses held 18,384.725 BTC as of 10 a.m. Eastern Time on November 7, while not reflecting the newly reported 2,300 BTC. Such differences can arise from the timing of data collection, different address clusters, changes in labeling and the way analysts distinguish original holdings from newly converted funds.
A balance that has not moved is not necessarily a balance that is safe, frozen or unrecoverable. It simply means that no material transfer was detected during a particular observation period. Future movement would depend on the attackers’ decisions, the controls applied by exchanges and other service providers, and continuing cooperation between investigators and blockchain analytics firms.
For institutional wallets and custodians, the episode also reinforces the need to connect balance management with operational controls. Permission structures, withdrawal approvals, address allowlists, anomaly detection and post-incident audit trails are most effective when they operate as one control framework. Transparent transaction records help create an evidence trail, but they do not automatically provide the ability to reverse a transfer or recover assets.
Binance faces operational and governance scrutiny
According to TechCrunch, Binance froze withdrawals for several days after the attack. Once accounts were unfrozen, users withdrew a net $3.6 billion in the first few hours. Binance said it would bear the financial impact of the stolen funds and would not pass those losses on to users. Binance and the Federal Bureau of Investigation attributed the attack to TraderTraitor, described as a North Korea-linked group. The materials available for this report do not provide a complete technical account of the intrusion or identify all affected accounts.
The incident was followed by a leadership change. Binance CFO Kaiser Ng announced that he was leaving the exchange to pursue a new venture. Co-CEO Yi He said a transition plan had been implemented over the preceding six months, and Justin Yek was named as the incoming CFO. The departure does not, on the available evidence, establish a direct causal link to the hack. It does place a senior management transition alongside the company’s security response, withdrawal restart and commitment to absorb user losses.
The scale of post-incident withdrawals is also relevant to how exchanges manage confidence and liquidity during a security event. Restoring access too quickly can expose users to unresolved risks; keeping withdrawals suspended for too long can create operational and trust costs. A credible response therefore requires more than a technical patch. It involves communicating what is known, defining which functions can safely resume, monitoring unusual activity and explaining how losses and claims will be handled.
What the event says about custody and cross-chain governance
The reported flow brings together three issues that are often treated separately: exchange security, post-incident liquidity management and the tracing of stolen assets after they leave the original platform. A large exchange must protect user accounts and signing systems, but it must also distinguish ordinary withdrawals from suspicious activity once service resumes. It may need to restrict selected routes without imposing unnecessary disruption on unaffected users.
Cross-chain activity makes that task a shared governance problem. Exchanges, custodians, wallet providers, protocols and analytics firms each see only part of the path. If information is not exchanged quickly, an attacker can exploit differences in response times and risk classifications. Conversely, indiscriminate freezing can create legal and customer-service problems. The practical challenge is to combine rapid containment with documented procedures, proportional controls and coordination with law-enforcement authorities.
For institutional custody operations, the central lesson is that on-chain visibility and recovery capability are different things. Blockchains can preserve a detailed transaction history, but that history does not guarantee that a transfer can be reversed, that an intermediary will accept a freeze request or that an asset can be recovered. The next phase of the Binance investigation will therefore depend not only on additional address tracing, but also on how exchanges, cross-chain services, custodians, analytics providers and regulators coordinate when allegedly stolen assets continue to move.
Source: link