Binance Hack, where are the coins right now?

Ethereum network.
The attacker drained about $3.70B from Binance 14, Binance 7 and a Binance hot wallet into one receiver address, then split it.

Tether and Circle moved fast. $2.20B of stablecoins ($1.38B USDT and $823M USDC) is frozen across three addresses, the red nodes.

Before the freeze landed the hacker sold about $435M USDT for ETH through 0x Protocol, 1inch, LiFi and Uniswap, the four swap hubs in the middle of the chart. Nothing has touched a centralized exchange, bridge or mixer.

Another $60M USDT is locked as Aave v3 collateral behind a 19.8K WETH loan.

What the hacker still controls. 462.6K ETH (about $1.04B) in 11 addresses, three of which hold 85% of it, plus roughly $0.40B in other tokens (XAUT, WBETH, ENA, RLUSD, USD1 and a long tail) that are being sold into DEX pools one wallet at a time.

On the Bitcoin network, all 18,270 BTC (about $1.42B) went from Binance cold wallet through one staging address into 19 fresh addresses, 17 of them hold exactly 1,000 BTC, and not one has moved since.