Blockchain analytics firm Elliptic identified early signs of bitcoin mixing by the Binance attackers, with approximately 28 bitcoin worth $2.2 million passing through 18 mixing transactions by November 2, 2026.

Overview Debates Related claims Topics Sources

Cc9f267dcClaim

New Market Trading CEO Frank Hepworth stated that bitcoin lending yields of 1% to 4% fail to justify derivative, counterparty, and smart contract risks.

Cc9f267dcClaim

Between November 1 and early November 2, 2026, hackers passed roughly 28 Bitcoin worth $2.2 million through 18 CoinJoin privacy transactions using the WabiSabi protocol.

Cc9f267dcClaim

The Bank of Korea survey includes a scenario asking financial institutions to assess operational risks stemming from a steep decline in Bitcoin prices accompanied by a prolonged slump in trading volume.

Cc9f267dcClaim

Elliptic reported on November 2, 2026 that stolen Binance assets were laundered across roughly 12,000 wallets and over 40,000 transactions spanning 11 blockchains, averaging one new wallet every 25 seconds.

Cc9f267dcClaim

The 18,270 Bitcoin stolen directly from Binance remained unmoved in 19 addresses, while the Bitcoin mixed through CoinJoin came from assets converted after the October 29, 2026 theft.

Cc9f267dcClaim

Frank Hepworth warned that covered-call strategies on bitcoin during bull markets risk having assets sold at option strike prices, forfeiting upside potential.

Cc9f267dcClaim

The conversion of stolen Solana tokens into Bitcoin marked an expansion of laundering routes after temporary holding wallets on the Tron network were largely emptied.

Cc9f267dcClaim

On-chain analysts estimated that despite issuer freezes, the Binance attackers retained control of roughly $3.24 billion to $3.5 billion in stolen cryptocurrency.

Cc9f267dcClaim

In the first four days following the Binance hack, attackers utilized roughly 12,000 temporary wallets across 11 blockchains and conducted over 40,000 transactions to obscure funds.

Cc9f267dcClaim

The Federal Bureau of Investigation, Secret Service, and IRS Criminal Investigation requested cryptocurrency services and operators to block transactions linked to identified Binance attacker wallet addresses.

Cc9f267dcClaim

The Binance attackers moved 486,970 Solana tokens worth roughly $46.4 million within one hour using Relay Protocol to execute cross-chain swaps into Bitcoin.

Cc9f267dcClaim

The stolen Premia Labs assets were bridged from Arbitrum to Ethereum before being converted into Bitcoin using cross-chain platforms Chainflip and NEAR Intents.

Cc9f267dcClaim

North Korean-backed threat group TraderTraitor deployed AI-enabled automated operations to repeatedly rotate stolen cryptocurrency across multiple new addresses and swap venues.

Cc9f267dcClaim

The Federal Bureau of Investigation requested decentralized finance operators help freeze stolen cryptocurrency funds passing through their infrastructure.

Cc9f267dcClaim

Elliptic determined that regular time intervals and fixed transfer amounts in the Binance hack laundering were driven by conventional automation scripts rather than artificial intelligence software.

Cc9f267dcClaim

Attackers used lending vaults to deposit crypto assets from one address and withdraw to others without direct wallet transfers, alongside Thorchain cross-chain swaps.

Cc9f267dcClaim

Embedded messages attached to transactions sent to the Binance attacker wallets included phishing links mimicking THORChain swap sites, promotions for the $NST token, and requests for treats.

Cc9f267dcClaim

Bitcoin deposited through b14g was unaffected by the October 31, 2026 exploit, remaining time-locked on the Bitcoin blockchain.

Cc9f267dcClaim

Blockchain analytics traced stolen CORE tokens moving through wallets connected to infrastructure at Bybit, Gate.io, and MEXC following the October 31, 2026 b14g exploit.

Cc9f267dcClaim

New Market Trading CEO Frank Hepworth stated that bitcoin lending yields of 1% to 4% fail to justify derivative, counterparty, and smart contract risks.

Between November 1 and early November 2, 2026, hackers passed roughly 28 Bitcoin worth $2.2 million through 18 CoinJoin privacy transactions using the WabiSabi protocol.

The Bank of Korea survey includes a scenario asking financial institutions to assess operational risks stemming from a steep decline in Bitcoin prices accompanied by a prolonged slump in trading volume.

Elliptic reported on November 2, 2026 that stolen Binance assets were laundered across roughly 12,000 wallets and over 40,000 transactions spanning 11 blockchains, averaging one new wallet every 25 seconds.

The 18,270 Bitcoin stolen directly from Binance remained unmoved in 19 addresses, while the Bitcoin mixed through CoinJoin came from assets converted after the October 29, 2026 theft.

Frank Hepworth warned that covered-call strategies on bitcoin during bull markets risk having assets sold at option strike prices, forfeiting upside potential.

The conversion of stolen Solana tokens into Bitcoin marked an expansion of laundering routes after temporary holding wallets on the Tron network were largely emptied.

On-chain analysts estimated that despite issuer freezes, the Binance attackers retained control of roughly $3.24 billion to $3.5 billion in stolen cryptocurrency.

In the first four days following the Binance hack, attackers utilized roughly 12,000 temporary wallets across 11 blockchains and conducted over 40,000 transactions to obscure funds.

The Federal Bureau of Investigation, Secret Service, and IRS Criminal Investigation requested cryptocurrency services and operators to block transactions linked to identified Binance attacker wallet addresses.

The Binance attackers moved 486,970 Solana tokens worth roughly $46.4 million within one hour using Relay Protocol to execute cross-chain swaps into Bitcoin.

The stolen Premia Labs assets were bridged from Arbitrum to Ethereum before being converted into Bitcoin using cross-chain platforms Chainflip and NEAR Intents.

North Korean-backed threat group TraderTraitor deployed AI-enabled automated operations to repeatedly rotate stolen cryptocurrency across multiple new addresses and swap venues.

The Federal Bureau of Investigation requested decentralized finance operators help freeze stolen cryptocurrency funds passing through their infrastructure.

Elliptic determined that regular time intervals and fixed transfer amounts in the Binance hack laundering were driven by conventional automation scripts rather than artificial intelligence software.

Attackers used lending vaults to deposit crypto assets from one address and withdraw to others without direct wallet transfers, alongside Thorchain cross-chain swaps.

Embedded messages attached to transactions sent to the Binance attacker wallets included phishing links mimicking THORChain swap sites, promotions for the $NST token, and requests for treats.

Bitcoin deposited through b14g was unaffected by the October 31, 2026 exploit, remaining time-locked on the Bitcoin blockchain.

Blockchain analytics traced stolen CORE tokens moving through wallets connected to infrastructure at Bybit, Gate.io, and MEXC following the October 31, 2026 b14g exploit.

According to Chainalysis, North Korea-based threat actors accounted for nearly 90% of cryptocurrency hack losses in 2026, up from 15% in 2021.