Elliptic says Binance hack sees CoinJoin use and 44% of stolen funds frozen

Elliptic traced $6.43 bn stolen from Binance across 11 blockchains, 12,000 wallets and 40,000 transactions, noting a major role for Tron and a link to the Bitget hack.

By Divyansh Mishra, YourKhabri DeskNov 2, 2026, 11:47 AM UTC1 min readBinancehacklaunderingCoinJoin

Key takeaways

1$6.43 bn stolen from Binance across 11 blockchains, 12,000 wallets and 40,000 transactions
244 % ($2.85 bn) of the stolen funds have been frozen or seized

Elliptic said on 2 November 2026 that the hacker who stole roughly $6.43 billion from Binance has used CoinJoin for the first time, and that 44 percent of the stolen funds have been frozen or seized.

The analysis traced the proceeds across 11 blockchains, involving about 12,000 wallets and more than 40,000 transactions. About $2.85 billion has been frozen, while $3.24 billion remains in linked addresses. Tron was a major conduit, with funds spread over roughly 7,700 addresses, and around $16 million was sent to wallets linked to the earlier Bitget hack.

Binance is the world’s largest crypto exchange, handling billions of dollars daily. Elliptic provides blockchain‑risk analytics and often works with law‑enforcement agencies. The theft, first reported on 31 October 2026, is the biggest breach in crypto history, prompting Tether to freeze $971 million of USDT and Thorchain to pause bridges handling $2.5 billion. Earlier reports noted North‑Korea‑linked actors moving stolen Binance assets onto Solana.

The use of CoinJoin indicates the attacker is adopting privacy‑enhancing tools to obscure trails, raising challenges for investigators. However, the fact that nearly half of the proceeds are already frozen shows that coordinated tracking efforts are effective. Traders will watch whether additional funds are recovered and whether other mixers see a surge in activity.

Also reported by

Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.