Binance Hacker Begins Laundering Stolen Bitcoin via CoinJoin

Between November 1 and November 2, researchers at Elliptic identified 18 separate CoinJoin transactions involving 28 BTC. The funds originated from assets converted after the initial theft, utilizing the WabiSabi protocol common to Wasabi Wallet to pool participants and complicate chain analysis. Despite this movement, the primary cache of 18,270 BTC stolen directly from the exchange remains dormant across 19 addresses.

Elliptic’s investigation, which spanned 11 blockchains and 40,000 transactions, estimates that approximately 44% of the stolen funds have been effectively neutralized through freezing or seizure orders. Stablecoin issuers, including Tether and Circle, along with governance interventions on networks like Arbitrum and Optimism, have played a critical role in restricting access to these assets. However, native cryptocurrencies such as Bitcoin, Solana, and XRP remain largely beyond the reach of centralized intervention.

Binance is proceeding with a separate recovery plan, having committed over $6.3 billion to replenish user accounts. By October 31, the exchange reported that 90% of the required replenishment was complete, sourced from the Secure Asset Fund for Users and corporate reserves. As the exchange works to restore liquidity for less common tokens, the FBI continues to attribute the sophisticated, automated distribution patterns—which saw funds moved at hourly intervals—to the North Korean-linked group, TraderTraitor.