Elliptic Traces Binance Hack Funds Through 12,000 Wallets

Elliptic traced crypto stolen in the Binance hack through about 12,000 wallets in less than four days; roughly $3.24 billion, mostly Ether and Bitcoin, remains in addresses tied to the theft.

The activity spanned 11 blockchains and more than 40,000 transactions. Elliptic identified Tron as the main route: funds were divided among about 7,700 addresses, then at least $147 million crossed a bridge to Ethereum.

Since Nov. 1, Ether (ETH), Solana (SOL), NEAR and XRP have also moved. On Nov. 2, about 233 million XRP moved to six new addresses. The 18,270 Bitcoin (BTC) stolen in the attack has not moved since it was split among 19 addresses on the day of the theft. About 28 BTC, worth roughly $2.2 million, entered CoinJoin transactions, the first mixing identified in the stolen funds.

Elliptic found no evidence that AI agents made decisions during the laundering. The timing and repeated amounts instead fit automated scripts, including retries that repeated failed transactions. New methods appeared in stages, with pauses resembling a human schedule.