Binance investigators have intensified efforts to recover USD 6.3 billion in stolen cryptocurrencies as attackers move funds between wallets to avoid asset freezes.
The exchange said roughly USD 3 billion had been frozen following the October 29 breach. However, Binance has not confirmed how much has returned to its control. Blockchain analysts are tracking the remaining assets while examining possible links to North Korean hackers.
The attackers moved quickly after gaining control of Binance hot wallets, which the exchange uses to process withdrawals. According to TRM Labs, they transferred USD 6.36 billion across multiple blockchains, with most of the theft taking place within about 20 minutes.
Stablecoin issuers responded by blocking addresses holding stolen tokens. Tether froze affected USDT, while Circle restricted USDC. Meanwhile, investigators found that the attackers had converted hundreds of millions in stablecoins into Ether before issuers could block further transfers.
The conversion made recovery more difficult. Unlike USDT and USDC, Bitcoin and Ether have no central issuer that can freeze transactions. Exchanges can still intercept those assets when attackers transfer them to accounts under their control.
However, freezing stolen tokens does not mean investigators have recovered them. Binance must still work with issuers and authorities to secure the assets and arrange their return.
The attackers also took 18,270 BTC worth around USD 1.4 billion. According to CoinDesk, that exceeds Tesla's reported holdings of 11,509 BTC and is more than twice El Salvador's Bitcoin reserve of roughly 7,820 BTC.
The stolen amount also comes within 442 BTC of SpaceX's reported holdings of 18,712 BTC. The figures for Tesla and SpaceX reflect their reported September 30 holdings, while El Salvador's reserve figure dates to October 30.
Blockchain records show the attackers initially moved the Bitcoin through 11 transactions before distributing it across 19 addresses. Seventeen wallets received exactly 1,000 BTC each, while the remaining two held smaller amounts.
Meanwhile, Chainalysis reported that the attackers used thousands of transactions to move other stolen assets between addresses. Some funds repeatedly returned to previously used wallets, creating additional work for investigators.
TRM Labs' Ari Redbord described the investigation as a continuing "cat and mouse game" in comments to CNBC. Analysts are following the transactions while the attackers attempt to conceal the movement of stolen cryptocurrency.
Investigators are also monitoring whether the attackers use professional laundering networks to exchange stolen cryptocurrency for traditional currencies.
Chainalysis CEO Jonathan Levin told CNBC that such networks can purchase stolen assets through private transactions and return value to criminals after charging a fee. However, investigators have not confirmed that the Binance attackers have completed such transactions.
TRM Labs attributed the breach "with high confidence" to North Korea-linked TraderTraitor, a group previously connected to the Bybit hack. Binance has not publicly confirmed the attackers' identities.
The exchange has set aside more than USD 6.34 billion in company funds to cover losses, including USD 5 billion in matching tokens.
Binance expects to begin restoring withdrawals on November 1, subject to security checks, and publish updated proof-of-reserves results on November 2. Investigators continue tracing the stolen assets as recovery efforts proceed.
ALSO READ: Elon Musk Warns AI Agents Could Hack Crypto to Fund Themselves After Binance Breach