Of the $6.43 billion stolen from Binance, about $2.85 billion has been frozen or seized, accounting for 44%—in less than four days. An Elliptic report on November 2 said about $3.24 billion remains in associated addresses, mainly $ETH and $BTC .

The money laundering spanned 11 chains, about 12,000 wallets, and more than 40,000 transactions. The main channel was Tron: funds were split across about 7,700 addresses, then moved to Ethereum via cross-chain bridges. Starting November 1, the attackers used CoinJoin for the first time to process about 28 Bitcoin, in 18 mixing transactions.

Freezing 44% in four days shows that exchanges’ responses made a difference, while automated splitting also left traceable footprints. The 28 BTC entering a mixing pool marks a shift: for the first four days, the funds were just being moved; now they’re starting to be hidden. Elliptic believes the amount cashed out may be very small, but $3.24 billion is still sitting in addresses. The question is whether it will stay there or start moving.

#币安被盗 #On-chain tracking