Binance Theft Funds Enter Bitcoin Mixing

Elliptic links the Binance theft to North Korean hackers; some of the stolen funds have begun entering Bitcoin mixing transactions, marking a new laundering phase.

The first Bitcoin deposits into mixing transactions occurred at 1:55 a.m. ET Sunday (05:55 UTC). By 1:02 a.m. ET Monday (06:02 UTC), about 28 Bitcoin (BTC), worth roughly $2.2 million, had passed through 18 such transactions.

The transactions used the WabiSabi protocol, which is used by Wasabi Wallet and other wallets. Each grouped 101 to 491 inputs, making it harder to trace which outputs corresponded to particular deposits.

Before mixing began, funds moved through roughly 12,000 wallets on 11 blockchain networks, generating more than 40,000 transactions in less than four days. The routes also included token swaps, at least seven cross-chain bridges and transfers through lending pools. On Tron alone, about 32,000 transactions were recorded.

Mixing combines many users’ Bitcoin inputs in a shared transaction, obscuring visible links between funds sent in and funds sent out. It does not itself convert funds to cash; the assets remain on public blockchains. Cashing out would require a centralized exchange or an over-the-counter broker, where transactions may be identified and stopped.