Elliptic determined that regular time intervals and fixed transfer amounts in the Binance hack laundering were driven by conventional automation scripts rather than artificial intelligence software.

Overview Debates Related claims Topics Sources

Elliptic reported on November 2, 2026 that stolen Binance assets were laundered across roughly 12,000 wallets and over 40,000 transactions spanning 11 blockchains, averaging one new wallet every 25 seconds.

The 18,270 Bitcoin stolen directly from Binance remained unmoved in 19 addresses, while the Bitcoin mixed through CoinJoin came from assets converted after the October 29, 2026 theft.

On-chain analysts estimated that despite issuer freezes, the Binance attackers retained control of roughly $3.24 billion to $3.5 billion in stolen cryptocurrency.

Blockchain analytics firm Elliptic identified early signs of bitcoin mixing by the Binance attackers, with approximately 28 bitcoin worth $2.2 million passing through 18 mixing transactions by November 2, 2026.

Attackers used lending vaults to deposit crypto assets from one address and withdraw to others without direct wallet transfers, alongside Thorchain cross-chain swaps.

Blockchain analytics traced stolen CORE tokens moving through wallets connected to infrastructure at Bybit, Gate.io, and MEXC following the October 31, 2026 b14g exploit.

On-chain investigator ZachXBT publicly identified and flagged $106 million in suspicious on-chain transactions linked to the Crédit Mutuel theft on November 2

On-chain data indicates attackers targeted BitMart wallets approximately 53 minutes before executing a $48.6 million exploit on Brazilian cryptocurrency exchange Mercado Bitcoin on November 2, 2026

On-chain data from Bitquery showed attackers drained approximately $391,000 from BitMart wallets across the Base, Arbitrum, and Optimism Ethereum layer-2 networks on November 2, 2026

Blockchain investigator ZachXBT reported on November 3, 2026, that an unidentified Western European institution suffered a suspected crypto theft exceeding $133 million

Blockchain investigator ZachXBT increased the estimated loss in the suspected European institution theft from $106 million reported on November 2, 2026, after identifying an additional $27 million in centralized exchange withdrawals

Blockchain investigator ZachXBT stated that the laundering patterns from the suspected $133 million European institution theft did not match the typical methods used by North Korea’s Lazarus Group

Analytics firm Bitquery reported that the attacker linked to the $133 million theft converted approximately $62.98 million in stablecoins into 27,553 Ether within roughly four hours

Transparent public blockchains allow third parties to deduce user identities by analyzing on-chain transaction patterns

Blockchain intelligence firm TRM Labs attributed the October 29 Binance breach to TraderTraitor with high confidence, citing transaction signature execution, Tornado Cash usage, and onchain commingling

Onchain investigator ZachXBT identified a connection between the October 29 Binance hack and the Bitget hack, finding stolen funds from both were commingled at the same address after passing through THORChain

Blockchain security firm Hypernative estimated that over $40 million in unauthorized transfers occurred across at least 10 blockchains linked to Mercado Bitcoin's wallets

Mercado Bitcoin published destination wallet addresses across EVM chains, Bitcoin, Solana, Stellar, and Tron on November 2, 2026, to assist on-chain fund tracking

According to security firm Hypernative, suspicious transfers linked to the hack on Mercado Bitcoin's hot wallets first appeared around 11 PM on November 1, 2026, in Brazil

Blockchain tracker Onchain Lens noted that total losses from the BloomTrading exploit could ultimately exceed the initial $954,000 estimate.