The first story about the Binance hack was about a key that signed something it should not have. This one is about what happens after the money leaves.

On October 29, attackers moved roughly $6.3 billion out of Binance’s hot wallets across at least ten blockchains — the largest crypto theft on record, according to CNBC. We reconstructed the first four minutes of that drain in our earlier piece: 50 signed EIP-7702 authorizations, a single call, 167,464 ETH and 1.6 billion USDT gone in one transaction.

Four days later, the more important question is no longer how the hot wallet fell. It is where the money is now, who can still stop it, and what the exchange’s repair job actually repaired.

What the FBI said, and when

On October 31, US time, the FBI attributed the theft to North Korea. Its alert names TraderTraitor, the state-sponsored cluster the bureau has linked to earlier crypto heists, and states that the stolen assets were being converted into Ethereum as the attackers prepared for “further laundering stages” (CNBC).

The alert did more than name a country. According to ForkLog, the FBI published hundreds of addresses tied to the attackers and urged THORChain node operators, DeFi protocols and other crypto services to restrict transactions with them. That is the practical part of an attribution: a list that exchanges and bridges can actually screen against.

It also confirms the shape of the operation. This was not a lone wallet thief moving coins by hand. TRM Labs told CNBC that several features match earlier North Korea-linked heists, including the Bybit hack and the KelpDAO hack in April 2026: small Tornado Cash withdrawals funding an operator wallet, staging that began well before the theft, and signatures obtained in advance and then executed in one burst.

The laundering leg: Tron first, then Solana

The stolen assets were not all in one form. Some were ETH, some were BTC, some were stablecoins and long-tail tokens. The launderers’ first job was to turn a multi-chain haul into something movable.

Tron became the main washroom. Researcher SomaXBT, tracing the flow day by day, counted about $242 million pushed out through the Tron leg in the first two days, according to ForkLog. Of that, roughly $44 million went through THORChain, $48 million through Relay and $32.1 million through Chainflip.

Chainalysis, which has been tracking the same flow, said the launderers used DeFi lending markets on Tron to stay ahead of stablecoin freezes from the early hours of the attack, and that funds have since begun moving beyond Tron — with Solana named as a destination. The firm cautioned that not all of the Tron money landed on Solana and did not confirm exact amounts.

Why Tron? It is cheap, fast, and carries the largest USDT supply of any chain. A billion-dollar balance is conspicuous; a thousand deposits of a few hundred thousand dollars each are not. Splitting is the whole trick, and it is why cross-chain bridges matter to launderers as much as to legitimate users.

The freeze map: what stops, and what cannot

This is where the story gets uncomfortable for anyone who believes a big hack ends with a big freeze.

Stablecoins can be stopped. Tether and Circle can blacklist addresses and freeze their own tokens. In our October 30 reconstruction, roughly $1.18 billion in USDT and $823 million in USDC were sitting at the first receiving address and had been frozen by the issuers. That is real money made unlootable.

Native coins cannot be stopped. ETH, BTC, SOL and TRX have no issuer, no support line, and no blacklist. Once the launderers convert stablecoins into native assets — or simply keep the native assets they already stole — no company can freeze them. Only a centralized venue choosing not to accept them can.

That is the asymmetry the attackers are exploiting. The FBI’s address list helps centralized exchanges and bridges refuse the funds. It does not reach a self-custodied wallet, a decentralized swap, or a mixer.

The accidental brake: THORChain’s bad day

One of the strangest details of the week is that the launderers were slowed by a bug, not by police.

On October 31, Ethereum had a one-block reorganization. A 10 ETH deposit to a THORChain vault sat in a block that was dropped from the canonical chain, but THORChain had already credited it. The protocol refunded the user, then discovered it had paid out ETH it never received. An automatic solvency check halted ETH swaps, and node operators stopped signing outbound transactions across ten chains within about two minutes (ForkLog).

Chainalysis noted the irony: for as long as the pause lasted, nobody could swap across most of THORChain’s bridges — including the North Korean laundering team. The user returned the extra 10 ETH. The pause was not a response to the FBI’s request; it was an accident that happened to land in the middle of a laundering operation.

It is a reminder that the choke points in this fight are mostly private infrastructure: bridges, exchanges, stablecoin issuers. They fail, they pause, and sometimes they accidentally do the right thing.

What Binance’s “90%” actually means

On October 31, Binance said it had restored backing for about 90% of the assets affected by the hack. It listed BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed at 100%, said the remaining 10% consists of less liquid tokens outside its top ten, and said it is buying them on the market and over the counter until coverage reaches 100% (CNBC).

The funding came from three places: its Secure Asset Fund for Users (SAFU), a portion of its futures insurance fund, and its corporate treasury.

Two things are true at once. Binance users can withdraw at par, which is what matters to them. And the stolen coins are still stolen — Binance repaired the hole in its balance sheet with its own money; it did not get the attacker’s coins back. “90% covered” is an accounting statement, not a recovery statement.

Withdrawals resumed on Sunday, November 1, starting with the Bitcoin network, then Ethereum and BNB Smart Chain. Binance’s initial explanation was a compromised DevOps engineer’s laptop that gave an attacker access to a service container; co-CEO Richard Teng later said the attack was more complex than the misuse of one engineer’s permissions. The company has not published a root-cause report.

What this means if you hold crypto

The practical lessons are not new, but this week made them expensive:

  • Exchange balances are credit, not custody. You are lending the exchange your coins and holding an IOU. Binance honoured its IOUs this time. Not every exchange can.
  • Freezes protect stablecoins, not your ETH. A portfolio that is 100% USDT feels safe until the USDT is converted and bridged. Native-asset exposure has no issuer backstop, which cuts both ways.
  • Address screening is now a user-facing skill. The FBI list is public. If you run a business that accepts crypto, screen incoming funds against sanctions and attacker lists, or you may be the one explaining a frozen deposit.
  • The CEX is where the trail ends or continues. Attribution only becomes recovery when a centralized venue refuses the deposit. That is why the FBI asked bridges and protocols to block, not just exchanges.

Bottom line

The Binance hack is no longer a single event with a single number. It is an ongoing operation with three moving parts: a laundering pipeline that is still running, a freeze perimeter that only covers issuer-backed tokens, and an exchange that chose to absorb the loss rather than pass it to users.

The $6.3 billion figure will keep moving as analysts refine it. What will not move is the structural fact: in crypto, theft is fast, laundering is automated, and recovery depends on a handful of private companies deciding to say no.

This article follows our October 30 on-chain reconstruction of the drain itself: Binance’s Hot Wallets Drained: What the On-Chain Record Shows.

Frequently Asked Questions

Did the FBI confirm North Korea stole the Binance funds?

Yes. On October 31, US time, the FBI said North Korean state-sponsored actors were responsible for the theft of more than $6 billion in virtual assets from Binance. It named the group TraderTraitor, the same cluster linked to earlier exchange heists, and said the stolen assets were being converted into Ethereum ahead of further laundering.

How much of the money has been frozen?

Less than the headline '90%' suggests. Binance's 90% figure describes how much of the shortfall it has covered with its own funds, not how much police or issuers clawed back. Freezes only work on assets with an issuer — USDT and USDC can be blacklisted, ETH and BTC cannot. Our own check on October 30 found roughly $2 billion in stablecoins frozen at the first receiving addresses.

Why is Tron always in the middle of these laundering trails?

Tron is cheap, fast, and hosts the largest USDT supply. That combination is useful for splitting a large balance into thousands of small deposits. Chainalysis said the Binance launderers also used DeFi lending markets on Tron to keep funds moving ahead of stablecoin blacklists. From Tron, the money was bridged onward — Solana is the destination named so far.

Does Binance covering 90% mean users got their money back?

It means Binance has restored the backing for about 90% of the affected balances, so withdrawals can be honoured at par. It does not mean the stolen tokens were recovered from the attacker. The exchange says the remaining 10% is mostly less liquid tokens outside its top ten, which it is buying on the market and over the counter.