FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

Hi, what are you looking for?

The FBI has officially pinned the $6 billion Binance hack on North Korea’s TraderTraitor as the attackers launder the stolen crypto.

By

Flipboard

Reddit

Whatsapp

Whatsapp

Email

The FBI has formally blamed North Korean state-sponsored hackers for the record-breaking Binance cryptocurrency heist and is asking the crypto industry to help stop the stolen funds from being laundered.The attackwas conducted on October 29. Hackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes. Binance estimates the impact at roughly $6.3 billion, the largest crypto theft on record.Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.The FBI released itsattributionon October 31, two days after the theft.“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.Advertisement. Scroll to continue reading.Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

The attackwas conducted on October 29. Hackers emptied Binance hot wallets on multiple blockchains, moving most of the funds out within roughly 20 minutes. Binance estimates the impact at roughly $6.3 billion, the largest crypto theft on record.Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.The FBI released itsattributionon October 31, two days after the theft.“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.Advertisement. Scroll to continue reading.Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Within hours, blockchain intelligence firms TRM Labs and Chainalysis linked the attack to the North Korean group TraderTraitor. Binance initially said the intrusion may have started with a DevOps engineer’s compromised laptop, and pledged to cover all losses.The FBI released itsattributionon October 31, two days after the theft.“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.Advertisement. Scroll to continue reading.Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

The FBI released itsattributionon October 31, two days after the theft.“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.Advertisement. Scroll to continue reading.Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

“The FBI, together with partners at the USSS and IRS-CI, has observed TraderTraitor actors converting stolen assets primarily into Ethereum (ETH). It is expected these assets will then be further laundered by converting them using DeFi and instant swap services as they prepare them for further laundering stages,” the agency said.The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.Advertisement. Scroll to continue reading.Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

The alert names 608 Ethereum addresses, 19 Bitcoin addresses and one Solana address that currently hold, or previously held, proceeds of the theft.Advertisement. Scroll to continue reading.Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Together with the Secret Service and IRS-CI, the FBI called on THORChain node operators, RPC node operators, instant exchanges, DeFi services and blockchain analytics firms to refuse transactions linked to these addresses.The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

The FBI previously blamed the same group for the$1.5 billion Bybit hackin February 2025.Binance says the attack went beyond one laptopBinance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Binance has since expanded on its early findings. “Our initial investigation suggested that the security incident may have involved a compromised laptop, however our subsequent investigation has uncovered additional points of breach,” Binance co-CEO Richard Teng said in astatement.Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Teng described the incident as a complex attack that “was not carried out by one person.” He said the attacker also deployed a self-destruct mechanism that wiped its tooling and evidence, complicating the investigation.He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

He said the attacker’s use of Ethereum’s EIP-7702 delegation feature “did not pass through our normal approval controls.” Binance has not yet detailed the additional breach points, and has promised a technical post-mortem once the facts are verified.Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Binance began a phased resumption of withdrawals on November 1, starting with the Bitcoin network. By mid-morning on Sunday, it said it had processed about $4.6 billion in withdrawals and $1 billion in deposits.According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

According to the exchange, about 95% of the stolen amount has now been replaced using company funds, and Binance is buying the remaining less liquid tokens on the market and through over-the-counter deals.“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

“Our commitment remains clear: Binance will absorb the financial impact of the stolen funds, not our users,” Teng said.Laundering appears to be automatedBlockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Blockchain analytics firm Ellipticputs the theft at $6.43 billionacross 11 blockchains. Of that, it has confirmed $2.85 billion as frozen or seized on-chain.According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

According to Elliptic’slatest figures, the attacker controls about $3.25 billion in assets that no issuer can freeze, spread across more than 800 addresses. These include roughly 584,000 ETH, 18,327 BTC and 233 million XRP.“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

“In the Bybit hack, the laundering followed human working patterns. The Binance funds are being moved by something that does not sleep,” Elliptic said.The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

The main wallet distributing funds on Tron kept paying out hourly for more than a day, around the clock. When a cross-chain bridge refused deposits, the system rerouted the money to the same destination through freshly created wallets.By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

By late October 31, about $196 million had flowed from that wallet to roughly 200 other wallets. THORChain was the largest exit route, at about $31 million.Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Elliptic said on-chain data cannot show whether the automation relies on AI agents or conventional scripts. It expects the laundering to take months, as it did after the Bybit heist.Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Chainalysis also reportedlaundering patterns indicating automation, including thousands of transactions in a short period and many new addresses whose first transfer was exactly 1 TRX.Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Related:$2 Million+ Drained From Polymarket Traders in New Supply Chain AttackRelated:Hackers Return $263 Million Stolen From Liquid Network

Related:Hackers Return $263 Million Stolen From Liquid Network

Eduard Kovacs (@EduardKovacs) is senior managing editor at SecurityWeek. He worked as a high school IT teacher before starting a career in journalism in 2011. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.

Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.

Barracuda has appointed Dan Fletcher as CFO.

Artemis Security has appointed Arun Singh as CGO.

General Paul M. Nakasone has joined Armadin’s Board of Directors.

As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)

Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)

The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)

Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)

Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)

Flipboard

Reddit

Whatsapp

Whatsapp

Email

Got a confidential news tip? We want to hear from you.

Reach a large audience of enterprise cybersecurity professionals

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.