Elliptic reported on November 2, 2026 that stolen Binance assets were laundered across roughly 12,000 wallets and over 40,000 transactions spanning 11 blockchains, averaging one new wallet every 25 seconds.

Overview Debates Related claims Topics Sources

The 18,270 Bitcoin stolen directly from Binance remained unmoved in 19 addresses, while the Bitcoin mixed through CoinJoin came from assets converted after the October 29, 2026 theft.

The conversion of stolen Solana tokens into Bitcoin marked an expansion of laundering routes after temporary holding wallets on the Tron network were largely emptied.

On-chain analysts estimated that despite issuer freezes, the Binance attackers retained control of roughly $3.24 billion to $3.5 billion in stolen cryptocurrency.

In the first four days following the Binance hack, attackers utilized roughly 12,000 temporary wallets across 11 blockchains and conducted over 40,000 transactions to obscure funds.

The Federal Bureau of Investigation, Secret Service, and IRS Criminal Investigation requested cryptocurrency services and operators to block transactions linked to identified Binance attacker wallet addresses.

Blockchain analytics firm Elliptic identified early signs of bitcoin mixing by the Binance attackers, with approximately 28 bitcoin worth $2.2 million passing through 18 mixing transactions by November 2, 2026.

North Korean-backed threat group TraderTraitor deployed AI-enabled automated operations to repeatedly rotate stolen cryptocurrency across multiple new addresses and swap venues.

The Federal Bureau of Investigation requested decentralized finance operators help freeze stolen cryptocurrency funds passing through their infrastructure.

Elliptic determined that regular time intervals and fixed transfer amounts in the Binance hack laundering were driven by conventional automation scripts rather than artificial intelligence software.

Attackers used lending vaults to deposit crypto assets from one address and withdraw to others without direct wallet transfers, alongside Thorchain cross-chain swaps.

Blockchain analytics traced stolen CORE tokens moving through wallets connected to infrastructure at Bybit, Gate.io, and MEXC following the October 31, 2026 b14g exploit.

According to Chainalysis, North Korea-based threat actors accounted for nearly 90% of cryptocurrency hack losses in 2026, up from 15% in 2021.

On-chain investigator ZachXBT publicly identified and flagged $106 million in suspicious on-chain transactions linked to the Crédit Mutuel theft on November 2

The Office of the Comptroller of the Currency issued a consent order against Anchorage Digital in 2022 regarding anti-money laundering and compliance issues, which was lifted in 2025 following compliance infrastructure investments

U.S. retail customers will access the perpetual futures market through futures commission merchants subject to standard Know Your Customer and Anti-Money Laundering checks

THORChain processed approximately 200 million dollars in transaction volume for North Korean hacker addresses within two days of resuming network operations

On-chain data indicates attackers targeted BitMart wallets approximately 53 minutes before executing a $48.6 million exploit on Brazilian cryptocurrency exchange Mercado Bitcoin on November 2, 2026

On-chain data from Bitquery showed attackers drained approximately $391,000 from BitMart wallets across the Base, Arbitrum, and Optimism Ethereum layer-2 networks on November 2, 2026

The deferred prosecution agreement between Block Inc. and the Department of Justice places the company under federal supervision for three years, during which any compliance failure could reactivate the criminal money laundering charge

Block Inc. reached an agreement in principle with the U.S. Department of Justice on a three-year deferred prosecution agreement resolving a money laundering charge tied to anti-money laundering compliance program deficiencies