Chainalysis says Binance-stolen funds partly flow into Chinese laundering network
Blockchain analytics company Chainalysis said that hackers behind the roughly $6.3 billion theft of Binance funds are transferring some of the stolen assets through Chinese laundering networks, including over-the-counter trading platforms. It has so far tracked hundreds of thousands of dollars flowing into the related networks, only a small fraction of the total stolen amount, indicating that the hackers are trying to cash out the funds.
Chainalysis data shows that the hackers have transferred about $500 million through the TRON network, dispersing it across more than 1,000 addresses before moving it to networks such as Ethereum and Bitcoin. Crypto companies have now frozen about $3 billion in stolen assets, while another roughly $2.42 billion in BTC and ETH has barely moved since the theft; the remaining nearly $1 billion has begun entering laundering channels.
A Binance spokesperson said the company is working with law enforcement, on-chain analytics companies and stablecoin issuers to track and freeze the related assets. U.S. authorities have attributed the attack to North Korea’s TraderTraitor group.
Original source:
Title: Binance Hack Funds Flow to Chinese Launderers, Chainalysis Says Publisher: Bloomberg Date: 2026-11-05 URL: https://www.bloomberg.com/news/articles/2026-11-05/binance-hack-funds-flow-to-chinese-launderers-chainalysis-says Nature of source: financial media report (citing Chainalysis analysis) Verification status: We read the Bloomberg report summary and accessible portions; the TRON transfers and frozen amounts were cross-checked against Chainalysis’ public post and earlier analysis Supporting content: supports that some stolen assets were transferred through Chinese laundering networks and that hundreds of thousands of dollars have been tracked
ABAB AI Insight
Chainalysis tracking shows that only hundreds of thousands of dollars from Binance’s stolen funds have entered Chinese laundering networks, a tiny fraction of the total. This small-scale flow, alongside the pattern of hackers dispersing about $500 million across more than 1,000 addresses through TRON and then transferring it across chains, suggests that the current stage is focused on dispersal and testing cash-out channels rather than large-scale liquidation.
On the capital path, about $3 billion has been frozen, about $2.42 billion in BTC and ETH has barely moved, and nearly $1 billion has entered laundering channels. The freezing mainly came from cooperation among stablecoin issuers and exchanges, while the unmoved funds reduce short-term cash-out pressure. The hackers’ cross-chain dispersal makes the delay in tracing and freezing longer.
A comparable case is previous crypto thefts tied to North Korean groups, which also used multi-chain dispersal and third-party laundering networks. The similarity is that funds first enter assets that can be frozen and then are converted into assets that cannot be frozen; the difference is that the scale of inflow into Chinese laundering networks in this case remains very small, and it is proceeding in parallel with TRON-based automated layering.
What this disclosure changes is the confirmed proportion of stolen funds entering a specific laundering channel, not the total amount frozen or the attribution of the hackers’ identity. The indicators to watch are whether the amount flowing into Chinese networks expands further, whether the TRON dispersal addresses are further emptied, and how the ratio between freezing and cash-out changes.
ABAB News · Cognitive Law
Hundreds of thousands of dollars flowing into a specific laundering network is only a tiny fraction of the stolen total and does not mean large-scale cash-out has begun.
The path of dispersing funds across more than 1,000 addresses on TRON before cross-chain transfers runs in parallel with directly entering identifiable laundering networks.
The frozen amount and the nearly unmoved BTC/ETH together make up the main part of the current fund status.