Attackers behind the $6.43 billion Binance breach have converted roughly $3 billion of stolen stablecoins into Ether and other native tokens that no issuer can freeze, according to blockchain analytics firms tracking the flows, as the exchange said it has replenished about 98% of the affected assets.
The Oct. 29 intrusion, described by Binance as the largest security incident in the industry's history, drained funds across 11 blockchains. Of the total, $3.46 billion, or about 54%, was held in stablecoins such as USDT and USDC, whose issuers can blacklist wallets on demand. That made conversion the attackers' first priority.
Tether froze the first USDT wallet on Ethereum 37 minutes after the stolen tokens arrived, but not before about $434 million had been swapped into ETH through decentralized exchanges including Uniswap, according to Elliptic. A further $59.9 million in USDT was posted as collateral on the Aave lending protocol to borrow 19,762 ETH. On Tron, roughly $234 million in USDT was converted to TRX through SunSwap before Tether could act.
Circle moved faster on its own token, freezing all $823 million in stolen USDC before any of it could be exchanged. Combined, about $2.85 billion has now been frozen or seized, leaving roughly $786 million of stablecoins that were converted before controls took effect.
Note: Figures reflect issuer freezes and exchange-reported interceptions as of Nov. 3-4; totals may shift with reconciliation and market prices.
The freeze campaign has been uneven. Tether ultimately blacklisted 11 wallets on Ethereum and Tron, but six had already been emptied, including one that moved $130 million in USDT less than a minute before the block took hold. Bitquery estimates about 71% of the stolen USDT, or $1.76 billion, was locked, with the remaining $729 million converted into ETH, TRX or parked in DeFi protocols first.
The laundering operation has been industrial in scale. Over three and a half days, the attackers moved funds through about 12,000 wallets and executed more than 40,000 transactions. The original theft ran from 8:05 p.m. to 11:56 p.m. UTC on Oct. 29, and the 18,270 BTC taken in that window was split across 19 addresses that have not moved since.
On Tron, a distribution wallet began pushing 684.6 million TRX to hundreds of new addresses on Oct. 30, eventually spreading funds across roughly 7,700 addresses. Most of the TRX was bridged to Ethereum and swapped for ETH. About 68,300 ETH now sits in some 830 small wallets, most holding between 10 and 100 ETH, with 89% concentrated in nine addresses that have been dormant since Oct. 30.
By Oct. 31 the attackers had added new routes, converting TRX into USDD, a stablecoin marketed as freeze-free, and using JustLend vaults to deposit on one address and withdraw on another, breaking the direct on-chain link between sender and recipient. Transfer volume through the distribution wallet climbed from under 12 million TRX an hour to a peak of 37 million TRX an hour, with about 1,300 transactions in a single hour at 8 a.m. UTC.
THORChain, a cross-chain liquidity protocol that requires no exchange account, became a central conduit. The service halted swaps on most chains on Oct. 31 because of an unrelated technical fault, but the attackers simply routed through other bridges and resumed on THORChain after it restored service on Nov. 3. The protocol's RUNE token rose about 10.6% to $0.637 on the restart, according to CoinDesk. The same protocol was used to move assets from the 2025 Bybit hack.
The destination of choice is increasingly Bitcoin. Between Nov. 3 and Nov. 4, the attackers shifted about 779,097 SOL, worth roughly $72 million, into 91 new wallets, with much of it sold for USDC, bridged to Ethereum via Circle's Cross-Chain Transfer Protocol, swapped into ETH and then converted to Bitcoin through THORChain. At least 497 BTC, worth about $39 million, was delivered to nine Bitcoin addresses in those swaps, and 366 BTC was further scattered to 62 fresh addresses. Lookonchain separately tracked an attempted conversion of 970,522 SOL, valued at $95.9 million at the time, including 486,970 SOL moved within a single hour.
Mixing has begun. From Nov. 1, Tron-derived funds converted to Bitcoin were fed into WabiSabi coinjoin transactions, a protocol used by Wasabi Wallet that combines inputs from multiple users to sever the visible link between deposited and withdrawn coins. By Nov. 2, about 28 BTC, then worth $2.2 million, had passed through 18 coinjoin rounds with 101 to 491 inputs each. The attackers have also deposited about 41 ETH and 9,600 SOL, together worth roughly $1 million, into Privacy Cash, a Tornado Cash-style privacy pool launched on Solana in August 2025 with backing from Alliance DAO.
Elliptic estimates that only a negligible share of the haul has actually been converted into fiat. Most activity so far has been asset swaps and dispersion, meaning the funds remain on public ledgers and traceable. The firm expects the attackers to keep converting ETH into Bitcoin in small tranches before attempting to sell through over-the-counter brokers over the coming months, a phase in which investigators and financial partners may get further chances to intercept the money.
Binance said it has set aside resources exceeding 100% of the losses, drawing on its Secure Asset Fund for Users, part of its futures insurance fund and corporate capital, and will absorb the hit rather than pass it to customers. The remaining 2% of replenishment covers mostly illiquid tokens that take longer to buy on the market or through OTC deals. The exchange has also expanded its proof-of-reserves disclosure to 44 tokens from 10, with zero-knowledge verification of the new data expected to take 50 to 60 hours.
Replenishment is not recovery. Binance has rebuilt the compromised wallet system, replaced affected devices, revoked breached credentials and added AI-based anomaly detection, and has brought in outside security firms to review the incident.
The FBI has attributed the breach to a group it calls TraderTraitor, which it links to North Korea, and published wallet addresses while urging THORChain node operators and other service providers to block related transactions. The same group is suspected in a September 2026 Bitget hack, and about $16 million of the Binance funds has already moved to addresses holding proceeds from that earlier theft.
The investigation has traced the intrusion to a multi-stage campaign. In June, an engineer installed a tampered AI coding tool that exposed wallet-team credentials. In September, attackers posing as recruiters approached another engineer with a fake interview and a malicious "assignment" file. They then used Binance's internal AI tools to reach other engineers' machines before penetrating the wallet-signing service on Oct. 29.
For investors, the case sharpens the divide between freezeable stablecoins and native assets such as ETH and Bitcoin. Stablecoin issuers now function as an emergency brake during exploits, but only for the minutes before funds are swapped. Proposed rules such as the GENIUS Act would formalize freeze obligations for authorized issuers, while decentralized protocols including THORChain face growing pressure to screen flows. The freezing achieved here, at 44% of the haul, already far exceeds the roughly 3% recovered after the Bybit incident, but further recoveries will be harder as the money settles into assets no one can blacklist.
