Just minutes after the Binance hack, $6.3 billion was split across more than 10,000 wallets; approximately $3.3 billion remains in the hands of the hackers, according to Chainalysis data.
Following the attack that cost Binance $6.3 billion, the hacker group fragmented the assets, transferring them through thousands of digital wallets, multiple blockchain networks, and trace-obscuring services like THORChain and Wasabi Wallet. The goal was to evade scrutiny from investigative agencies and freezes imposed by businesses in the industry.
According to blockchain analytics firm Chainalysis, within minutes of the attack, the stolen funds were broken down into smaller amounts and distributed across more than 10,000 digital wallets. From there, the assets continued to be transferred across multiple blockchain networks and transaction mixing services, creating a complex network that made tracing the funds difficult.
Half of the funds have been blocked, and $3.3 billion remains out of control.
Just hours after the attack, about half of the stolen assets were frozen as stablecoin issuers like Tether and Circle blocked the associated wallets. However, according to blockchain tracing firms, approximately $3.3 billion remains in the hands of the hackers.
To conceal the flow of funds, the perpetrators split the assets into smaller amounts and transferred them back and forth between blockchain networks and intermediary services. This is why the freezing of funds by stablecoin issuers only addresses a portion of the money.
THORChain: A bridge for exchange between blockchain networks
One of the platforms used was THORChain, a service that allows users to swap cryptocurrencies between different blockchain networks. Chainalysis stated that in the 72 hours following the Binance hack, THORChain processed over $46 million originating from the theft.
The platform also generated over $200,000 in transaction fees, which were distributed to those who participated in operating the system.
THORChain is no stranger to large-scale thefts. In 2025, after the Dubai-based Bybit exchange was robbed of $1.5 billion, the hacking group carried out nearly $1 billion in transactions through the platform. Chainalysis estimates that THORChain operators earned at least $12 million in transaction fees from that operation.
Wasabi Wallet: obscuring traces on the Bitcoin network.
Another service that emerged in the asset transfer market was Wasabi Wallet. Nearly $4 million was transferred through this platform during the same period. The service helps conceal the origin of cryptocurrency when assets are transferred between Bitcoin wallets.
The mechanism relies on a single coordinating party responsible for aggregating and processing transactions to obscure the flow of money. Data from the Wasabi Wallet tracking platform shows that currently, only one coordinating entity handles over 99% of transactions on the system.
The person behind the coordination operation is an American cryptocurrency developer using the pseudonym Kruw. According to Chainalysis, the income this person received from the coordination work was negligible.
Controversy: Who is responsible for decentralization?
Last weekend, the FBI urged cryptocurrency services to block transactions related to the Binance hack, specifically naming several operators of THORChain network nodes. Despite this, the platform continues to operate, and the wallets involved in the theft are still using Wasabi Wallet.
Developers argue that they cannot or are not obligated to intervene in every single transaction. In an online radio program in October, Chad Barraford, the American co-founder of THORChain, asserted that the system was not designed to block individual transactions or digital wallets. While traditional financial institutions must monitor and report transactions showing signs of money laundering, the decentralized finance sector has not been subject to similar strict regulation.
Conversely, Scott Armstrong, an attorney at Armstrong & Bradylyons and former federal prosecutor investigating cryptocurrency cases, argues that providing tools to help users avoid being traced after attacks seems to have become part of the business for some services. Regarding Wasabi Wallet, Kruw explained that maintaining privacy protection stems from a belief in individual liberty and anarchist capitalism.
The question of the true degree of decentralization.
The notion that developers cannot control transactions also raises questions about the degree of decentralization of these platforms. Investigators and investors question whether the system is truly free from the influence of a select group of individuals.
In the US, prosecutors have previously prosecuted operators of several blockchain services on charges of intentionally assisting in money laundering, and some cases have resulted in guilty verdicts.
Regarding THORChain, this issue arose in a 2025 lawsuit. Investors in a lending platform built on THORChain sued the two developers, Chad Barraford and John-Paul Thorbjornsen. According to the lawsuit, both had access to a special administrative key to interfere with the platform's operations. The plaintiffs alleged that Thorbjornsen used this tool to try to prevent the lending system from collapsing.
Barraford denied the allegations and did not respond to the Wall Street Journal's request for comment regarding THORChain's use in the Binance hack. Thorbjornsen, a former Australian Air Force pilot, said he is no longer directly involved in THORChain's operations. According to him, the controversial governance key has been removed, and the system is now maintained by 111 network nodes operated by several unnamed individuals.
Thorbjornsen asserted that THORChain has a significantly higher degree of decentralization than many other platforms, while emphasizing that charging fees is a normal practice for blockchain systems when users are present.
