Bitcoin mixing has entered the trail of the Binance hack: Elliptic identified about 28 BTC, worth roughly $2.2 million , flowing into Wasabi-style coinjoins. Its November 2 analysis marks the first mixing of stolen proceeds the blockchain analytics firm has detected since the October 29 theft.
Key takeaways
Elliptic’s investigation spans roughly 12,000 wallets on 11 blockchains.
The identified mixing uses WabiSabi, a protocol employed by Wasabi Wallet.
Elliptic recorded $2.85 billion in frozen or seized assets.
The FBI attributed the theft to North Korea’s TraderTraitor activity.
Elliptic tracks Binance hack assets across blockchains
Elliptic traced approximately 12,000 wallets across 11 blockchains connected to the stolen assets. It identified more than 40,000 transactions in under four days after the October 29 theft.
The firm said mixing started on November 1. By 1:02 a.m. ET on November 2, it had counted 18 coinjoin transactions involving the proceeds.
How Bitcoin mixing entered the Binance hack trail
Elliptic identified the WabiSabi protocol , which Wasabi Wallet and similar wallets use, in the mixing activity. Coinjoins pool bitcoin from multiple users into one transaction, making it more difficult to connect incoming coins with their owners’ resulting outputs, Wasabi’s documentation explains.
That differs from bridges, which move value between blockchains. Elliptic said the bitcoin entering coinjoins initially came from funds routed out of Tron, followed by bitcoin acquired through swaps of some parked ETH.
The 18,270 BTC stolen directly in the hack followed a different path: Elliptic said those coins had been distributed across 19 addresses and remained unmoved.
The firm attributed the activity to software scripts rather than AI-directed laundering. In its X update, Elliptic described it as “running on conventional automation,” citing regular timing, predetermined amounts and blind retries.
Stolen-asset balances and frozen funds
Based on asset prices at the time of the theft, Elliptic put the original theft’s value at $6.43 billion . Separately, it tracked roughly $3.24 billion still sitting in linked addresses, mostly in ETH and BTC, plus $2.85 billion that had been frozen or seized.
Unlike the original theft estimate, these remaining and frozen figures were calculated using prices from around 2 a.m. ET on November 2.
Even though Bitcoin mixing was detected among the proceeds of the Binance hack , Elliptic believes only a tiny fraction has actually been converted to cash so far. The firm pointed to stablecoins briefly held mid-transfer, along with centralized cashout platforms, as the most viable remaining chokepoints for intercepting funds, since native bitcoin and ETH fall outside the freezing powers that token issuers hold.
FBI attribution and recovery efforts
The FBI attributed the theft to North Korea ’s TraderTraitor activity on October 31. It urged cryptocurrency businesses and infrastructure operators to block transactions involving its listed addresses or funds originating from them.
On October 30, the US Secret Service said it was working with private-sector partners to identify, freeze, trace and recover the stolen funds. The agency further noted that it was working alongside the United States Attorney’s Office for the District of Columbia as well as other law enforcement partners.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
