Crypto Thief Who Robbed Binance Is Sitting On $484M And Hiding The Rest
Two days after the biggest crypto theft on record, the Binance hacker has not moved a single coin of the roughly $484 million in Ether parked in two wallets, while other parts of the haul are being laundered, according to blockchain records and analytics firm Chainalysis.
Key Takeaways
- 214,720 ETH, worth about $484 million, has sat untouched in two attacker wallets since early Friday
- About $2 billion in USDT and USDC is still frozen in the attacker’s main wallet
- The attacker is still selling smaller stolen tokens through fresh throwaway wallets, most recently on Saturday morning
- Chainalysis says the laundering on other chains is automated and unlike anything it has seen, and a THORChain outage has slowed part of it
- Binance has set aside $6.34 billion and moved 7,499 BTC from its emergency fund, with withdrawals due back early Sunday
This follows our first trace of the money on Friday. All times are UTC, and every wallet figure below was checked on Etherscan on Saturday evening.
The $484 Million That Has Not Moved
Most of the Ether the attacker took is sitting still. Two wallets hold almost all of it.
Source: Etherscan, checked Saturday evening. Values at about $2,253 per Ether.
Ether cannot be frozen by any company, so this money is free to move whenever the attacker chooses.
The Frozen $2 Billion Is Still Stuck
The attacker’s main wallet still holds 1,175,464,712 USDT and 823,000,000 USDC. Tether and Circle blacklisted it within hours of the theft, so none of it can move. Its Ether balance is now zero.
Binance said the total frozen across all chains stands at about $3 billion, a figure it repeated on Friday. Getting that money back is a separate legal process with the token issuers and law enforcement.
Still Selling The Smaller Tokens
The attacker has not stopped working. The pattern on Ethereum is the same each time. The main wallet sends a fresh address a little Ether to pay transaction fees, plus one batch of a stolen token. The new address sells it through Uniswap in a burst of trades, then goes quiet.
On Saturday morning it did this twice. At 04:39 it sent 0.05 ETH and 53.3 million ZAMA tokens to one new wallet. At 04:57 it sent 0.05 ETH and 1.69 billion SOPH tokens to another. Both started selling within minutes. On Friday night, the main wallet sent 0.5 ETH each to five other fresh wallets in the same way.
These are small sums next to the $484 million. But they show the attacker is active, patient with the big pile and busy with the small ones.
Also Read: Sam Bankman-Fried’s Old Bets Are Now Worth $61B, But FTX Sold Them For $6B
What Is Happening On Other Chains
Ethereum is only part of the story. Arkham, a blockchain tracking firm, counted 141 transfers on nine chains between 20:10 and 23:05 on Thursday, plus $300 million taken on XRP first. Of the total, $4.9 billion left Binance in the first 14 minutes.
Chainalysis says the money that can move is being washed in a new way. Its investigators are “observing never-seen-before laundering patterns,” it said on Friday, with thousands of transactions in a short time that suggest automation. Rather than moving funds forward, the attackers keep cycling them between addresses, often sending money back to wallets they used earlier.
On TRON, the attackers are racing the freezes. Chainalysis said on Saturday they are swapping stablecoins into receipt tokens from lending apps. Those tokens cannot be frozen like USDT, but whoever holds them can later swap them back into stablecoins from a clean address.
One escape route is shut for now. THORChain, a service that swaps coins between blockchains, paused cross-chain swaps on Saturday after an Ethereum glitch made it pay out a refund twice. That “inadvertently delayed the laundering of a significant amount of funds stolen from Binance,” Chainalysis wrote.
How Binance Is Paying For It
Binance says customers will not lose money. On Friday it said it had reserved $6.34 billion of company funds, with $5 billion already held in the exact tokens that were stolen, and was buying the rest on the market and through private deals.
By Saturday, 10 tokens were fully covered, including BTC, ETH, USDT, BNB, SOL and USDC, co-founder Yi He wrote. Binance is still buying smaller altcoins to fill the gap.
The company also tapped its SAFU emergency fund. A Bitcoin transaction on Saturday afternoon moved 7,499 BTC, about $581 million, out of the SAFU address, which held 7,825 BTC before the transfer. Yi He said Binance is using half of the SAFU fund’s money and keeping the other half in the fund. Binance has not explained how those two figures fit together.
Binance has also changed its account of how the attack happened. It first blamed a compromised engineer’s laptop, but said on Friday its investigation had “uncovered additional points of breach.”
North Korea’s Biggest Year
Chainalysis has said with “a high degree of confidence” that North Korea is behind the attack. Its numbers show how much the country now dominates crypto crime. Suspected North Korean hacks make up nearly 89% of reported hack losses this year, up from 15% in 2021, Chainalysis said. The average North Korean hack has grown from about $51 million in 2021 to $186 million in 2026, and the country is linked to $13.24 billion of the $22.34 billion in reported losses since 2021.
Read Next: $2.8B Pours Out Of Binance Wallets In One Night In Suspected Hack
What To Watch
- Withdrawals: Binance said on Friday morning they would restart in about 45 hours, which points to early Sunday
- Proof of reserves: a new snapshot was taken on Saturday, and the full proof that lets users check their own balances is due on Tuesday, Nov. 3
- THORChain: when swaps reopen, watch whether the two big Ether wallets start to move
- The full report: Binance has promised a technical post-mortem on how the attacker got in
