ABAB News Logo
Back to Flash News

Binance hacker has transferred or laundered nearly $900 million in funds

On November 10, on-chain monitoring account Onchain Lens posted that the Binance hacker has transferred or laundered nearly $900 million in funds. Of the stolen funds, which were estimated at a total of $6.34 billion, $891.37 million may have been transferred or laundered; $2.85 billion remains under the hacker’s control; and $2.6 billion has been frozen.

Onchain Lens said that over the past 2 to 3 days, the hacker has been actively moving funds through THORChain and Chainflip. The incident stemmed from a large-scale theft on October 29, 2026 targeting Binance’s hot wallet. Multiple institutions estimate the loss at about $6.3 billion to $6.4 billion, and the FBI and TRM Labs, Chainalysis, and others have attributed it to the North Korea-linked actor TraderTraitor. Binance previously said it had set aside company funds to cover the losses and had frozen some assets with partners.

Original source:

  1. Title: LET'S NOT FORGET THE BINANCE HACKER (Onchain Lens X post) Publisher: Onchain Lens (@OnchainLens) Publication date: 2026-11-10 URL: https://x.com/OnchainLens/status/2120157608762048725 Source nature: Original English post from an on-chain monitoring account Verification status: The original post content was actually read for this report (2026-11-10), and cross-checked against multiple media reports paraphrasing the same monitoring data and earlier mainstream coverage of the Binance incident Support: Supports Onchain Lens’s statements that, out of the estimated $6.34 billion in stolen funds, $891.37 million may have been transferred or laundered, $2.85 billion remains controllable, $2.6 billion has been frozen, and that funds were transferred through THORChain and Chainflip over the past 2 to 3 days.

ABAB AI Insight

Onchain Lens is an account focused on on-chain data monitoring and has previously tracked the addresses and fund flows related to this Binance incident. On October 29, 2026, attackers stole about $6.3 billion to $6.4 billion in assets from Binance’s multichain hot wallet, making it the largest recorded crypto theft. On October 31, the FBI attributed responsibility to the North Korean TraderTraitor unit, and TRM Labs and Chainalysis made similar attributions, noting signs of mixing with funds from earlier incidents such as Bitget.

In terms of fund flows, stablecoin issuers such as Tether and Circle, along with some on-chain partners, quickly froze about $2.6 billion to $2.85 billion in assets; among the remaining funds, some BTC, ETH, and other assets that are difficult to freeze remain under the attackers’ control. Onchain Lens’s latest monitoring shows that about $891 million may have been moved or laundered via cross-chain protocols, with recent active routes including THORChain and Chainflip. Earlier analyses, such as those by SomaXBT and Bitquery, also recorded cross-chain swaps through these and services such as Relay.

A comparable case is Bybit’s roughly $1.5 billion theft in 2025 and earlier North Korea-related crypto thefts, in which attackers often used cross-chain bridges, decentralized exchanges, and automated splitting to launder funds. The difference is that this incident is larger in scale, and the industry-coordinated freeze ratio is higher, while the attackers continue to try to move funds into censorship-resistant assets.

This update shows that some stolen funds are still being actively moved, with cross-chain protocols becoming one of the main exit routes. In the short term, progress in recovering frozen assets and further movement of the attackers’ controlled assets will determine the actual losses; in the long term, it will depend on law enforcement’s continued tracking of the relevant addresses and the compliance response of cross-chain protocols. Key indicators to watch are the fund flows of flagged addresses, the interception status of protocols such as THORChain and Chainflip, and Binance’s progress in covering the remaining shortfall.

ABAB News · Cognitive Laws

  1. After a large exchange hot wallet is stolen, stablecoin freezing and cross-chain bridge laundering can take place at the same time.

  2. The “may have been transferred or laundered” figure from an on-chain monitoring account is an estimate and should be distinguished from the final confirmed amount successfully laundered.

  3. Even if some funds are frozen, attackers may still control large sums through asset types that are difficult to freeze.