The 18,270 Bitcoin stolen directly from Binance remained unmoved in 19 addresses, while the Bitcoin mixed through CoinJoin came from assets converted after the October 29, 2026 theft.