Blockchain analytics firm Elliptic traced assets stolen from Binance across 16 blockchains and more than 20,000 wallet addresses by Nov. 7, showing how widely the funds had dispersed since the breach.
At its 3 a.m. ET (08:00 UTC) Nov. 7 cutoff, Elliptic had counted at least 65,000 transactions. It separately identified at least 36 services used in moving the proceeds. The Oct. 29 theft involved assets taken from 11 blockchains, five fewer than the number now appearing in the trail.
Elliptic estimated that about $3.13 billion in assets linked to the breach was still held in wallets, with Bitcoin (BTC) and Ether (ETH) accounting for most of the total. The main holdings of those two assets had not moved by the cutoff, even as other stolen assets were transferred or converted.
The firm put the amount frozen or seized by Nov. 7 at about $2.85 billion. Binance said on Nov. 3 that about $2.85 billion had been frozen or intercepted through containment efforts involving partners. The exchange said it would bear the financial loss rather than pass it on to users.
Binance said attackers gained access to an internal service that signs wallet transactions, enabling transfers outside the exchange’s normal withdrawal process. Elliptic identified bridges, decentralized exchanges, lending services and mixers along the subsequent trail. The firm said smaller transfers can reduce the price impact of conversions and attract less attention from exchanges that screen transactions.
Elliptic reported that by Nov. 7 the stolen Solana (SOL) had either been traded, transferred to another blockchain or routed through a mixing service. Some XRP had also been converted, mostly into Bitcoin. A separate portion of stolen assets worth about $175 million had been converted into roughly 2,300 BTC.
EconoTimes previously covered Binance-linked funds moving through Tron-based decentralized finance services. Elliptic compared the laundering pattern with the aftermath of the 2025 Bybit theft. It expects further conversions into Bitcoin and eventual attempts to cash out, and said it would continue updating its tracing.
