A single theft has left the Binance attacker trying to conceal a sum roughly 15 times Monero’s entire daily trading volume. Around $3 billion has already been frozen. Lending protocols have restricted access, and the remaining wallets are under continuous scrutiny.

The attacker’s next problem is finding enough liquidity, privacy and willing counterparties to turn the remaining crypto into usable money. At this scale, every major conversion risks attracting attention or sacrificing value, and laundering the proceeds has become significantly more complicated.

Binance put the impact of the October 29 attack at approximately $6.3 billion and said industry partners had frozen around $3 billion. Global Ledger estimated the remaining portfolio at approximately $3.19 billion in its initial assessment. Those figures reflect different observation times.

In this article, we break down why laundering billions in stolen crypto is far more complicated than moving it, what obstacles the Binance hackers face, and how limited liquidity, blockchain traceability, and coordinated industry responses make cashing out increasingly difficult.

Too much money to blend into the usual flow

Illicit services would need to handle an exceptional amount of money from one highly visible source. Finding somewhere to send it is only the first step. The attacker also needs enough trading depth to convert it and enough unrelated activity to obscure what happens next. The illicit infrastructure may simply lack the liquidity to absorb a theft of this size and dissolve it into its regular flows.

Global Ledger’s Laundering Race 2025 recorded more than $2.05 billion of inflows to Tornado Cash on Ethereum over the entire year. Sending half of the estimated $3.19 billion through that service would amount to approximately 78% of its full-year inflows.

Even a much smaller share would be substantial. Across 255 hacks in Global Ledger’s 2025 dataset, approximately $650.2 million reached mixers or privacy protocols—16.1% of the $4.04 billion stolen. Applying that historical share to $3.19 billion produces roughly $514 million, equivalent to a quarter of Tornado Cash’s annual Ethereum inflows.

A mixer can receive a large deposit. Concealing it is harder when one known theft accounts for so much of the new activity. The attacker’s own deposits increase the pool’s balance without creating unrelated users or independent transactions to hide among. Breaking the proceeds into thousands of transfers does not create thousands of independent sources.

Monero poses a different liquidity problem. CoinGecko reported approximately $216 million in 24-hour trading volume on October 30. The estimated $3.19 billion portfolio is nearly 15 times that turnover. Reported volume measures completed trades; it is not an offer to buy another $3 billion at the prevailing price. 

Monero can conceal transfers within its network. Acquiring a multibillion dollar position and later finding buyers are separate transactions in markets with limited depth. Large orders can move prices sharply, while a sudden surge in activity can draw attention to the conversion even when the subsequent private transfers remain hidden.

The industry is shutting off access

The first response has already restricted almost half the reported theft. Tether and Circle blocked large stablecoin holdings, while Ripple, World Liberty Financial and other issuers also intervened. Circle usually freezes USDC only under a court order or another formal legal process, while Tether typically acts on verified law enforcement requests. This time both acted without waiting for a court order, and the speed and breadth of the response were exceptional.

Arbitrum’s Security Council secured 8,425 ETH and approximately 74.6 million ARB. The intervention, only the second ETH freeze in Arbitrum’s history, again demonstrated that emergency powers on Arbitrum One can restrict an attacker’s ETH holdings. It does not extend to ETH held on Ethereum mainnet.

Lending protocols responded too. The attacker deposited approximately $60 million USDT into Aave and borrowed about 19,762 ETH before Aave restricted new deposits and borrowing. Kamino also paused borrowing in its SOL/BTC market. Aave subsequently reopened its V3 and V4 markets.

These measures interrupt a useful route for an attacker: posting stolen assets as collateral and borrowing something else. Protocols are assessing their exposure and trying to prevent their services from being used to move the proceeds. The NEAR team also indicated that it was prepared to block related transactions.

The disruption has reached users with no direct connection to the theft. Jupiter Lend reported a liquidity crunch affecting withdrawals, despite stating it had no Binance exposure. A morning API snapshot showed approximately 419.6 million USDC supplied to its USDC vault, with only about 7,900 USDC immediately withdrawable. Access to liquidity can tighten even at services that have lost nothing themselves.

The wallets are already being watched

The attacker is moving against an expanding network of labeled addresses, transaction alerts and public investigations. Researchers can monitor balances, identify new transfers and alert services when linked funds approach them.

Global Ledger is tracing the associated fund flows and labeling identified addresses in real time. A fresh wallet does not erase its funding history. Swaps and bridges add transactions and change the asset or network, but their public records can help investigators follow the proceeds.

Our 2025 dataset recorded approximately $2.02 billion crossing chains—about half of all stolen value. Monitoring those connections is essential because a receiving service may encounter the proceeds several transactions after the original theft.

AI can also assist investigators by organizing transaction data and flagging activity for review. The same advances that help attackers automate parts of their operations can help defenders work through larger volumes of evidence. Analysts still need to verify the links and distinguish a transfer between attacker wallets from a payment to an outside party.

Waiting carries a cost as well. The funds remain available for monitoring, and future movements can reveal additional links. Rushing to convert large holdings can mean worse prices and greater exposure to services prepared to intervene.

Why Bybit is not a precedent

The obvious counterexample is Bybit. In February 2025, attackers attributed to North Korea’s Lazarus Group stole about $1.4 billion in ETH and moved all of it within ten days, mostly by swapping it into bitcoin through THORChain. The case is often cited as proof that any sum can be laundered. It proves less than it seems.

Moving funds is not the same as cleaning them. Two months after the theft, Bybit reported that about 69% of the stolen ETH was still traceable and only about 28% had gone dark. The attackers changed the asset, not the visibility of the money.

The conditions have also changed. Bybit’s loss was almost entirely ETH on Ethereum mainnet, which no issuer could freeze. This time, around half of the theft sat in assets that could be frozen, and has been. The remaining portfolio is more than twice the size of the Bybit haul. THORChain, the main route in 2025, was publicly criticized for processing those flows, and some of its validators voted at the time to refuse hack-linked transactions.

Other exits run into the same limit. Bridges move funds between networks but leave public records on both sides. OTC brokers and underground banking networks can turn crypto into cash, but each needs counterparties willing to buy billions of dollars in assets that every compliance team is tracking, and to accept the sanctions and enforcement risk that comes with them. They can take small slices of the portfolio, not the whole of it.

Patience is the attacker’s last option. Some groups have held stolen funds for years before moving them. Here, waiting means billions sitting in labeled wallets while issuers, protocols and exchanges tighten their controls, and every later transfer starts from an address the industry already knows.

The consequences extend beyond Binance

Bybit and Bitget issued separate denials of reports that they had also been hacked. The Binance incident does not establish that other exchanges were compromised. It has nevertheless forced the wider industry to reassess access, exposure and the handling of suspicious funds.

For customers, the breach renews questions about how exchanges safeguard the assets they hold. Binance has pledged to cover losses through SAFU and company funds and publish updated Proof of Reserves after remediation. Its rebuilding of withdrawal controls, signing permissions and operational infrastructure will be central to restoring confidence.

The final outcome will depend on how much the attacker can convert, what counterparties will accept and how much more can be stopped. In theory, part of the remaining funds can still be moved. In practice, laundering them will be extremely difficult. The whole industry is watching these wallets, and it is taking steps that were long treated as off-limits: Circle freezing USDC without a court order, a layer-2 network freezing ETH, lending protocols shutting markets to keep the attacker out. The existing laundering infrastructure is not deep enough to absorb billions quietly, in the blink of an eye or at anything close to full value. For an attacker holding billions, a relatively simple exit no longer exists.

Global Ledger continues to monitor the case in real time. Our separate technical investigation will examine the attack and trace the funds across the affected blockchains.