Six Days After the Binance Hack: Where the $6.3 Billion Went

The October 29, 2026, Binance hack took around $6.3 billion from hot wallets across 10 blockchains in less than four hours, making it the largest crypto theft on record. As of November 4, about 95% of the stolen value remained at known addresses, either frozen or held by the attacker.

Compliance teams may encounter the remaining proceeds after swaps and intermediary transfers, with links to the hack becoming clear as more wallets are attributed. Investigators need to keep that connection intact across changing routes so they can act when funds reach an exchange or another point of intervention.

Global Ledger reconstructed the first six days of fund movements and examined 132 stablecoin freeze transactions by 12 issuers. This analysis brings those findings together with our research on the speed of money laundering to explain what the response achieved, how the remaining funds have moved and what compliance teams and investigators need to monitor next.

What Happened? The General Chronology

The theft began at 20:05 UTC on October 29 on the XRP Ledger and ended on Ethereum at 23:56 UTC, 3 hours and 51 minutes later. Binance has said the attack began with a fake job interview that compromised an employee's computer and gave the attackers access to an internal service.

The funds started moving almost at once. At 20:34 UTC, 29 minutes after the first theft, stolen assets reached their first counterparty. The first freeze of any token came at 20:57 UTC, when World Liberty Financial froze WLFI, and the first stablecoin freeze followed at 21:01 UTC. By then the attacker had been dealing with outside counterparties for 27 minutes.

Freezes and swaps continued through the night. Early on October 30, the Arbitrum Security Council moved about $30 million of the stolen funds to a holding address, where they await a governance vote. On October 31, the FBI attributed the hack to North Korea's TraderTraitor group and published the addresses it had linked to the theft.

On November 1, stolen SOL began moving towards Bitcoin, and on November 2 all 233.46 million stolen XRP moved into six new wallets. On November 4, a liquidator repaid 9,884.42 WETH of the attacker's debt on Aave and took 24.38 million USDT of the collateral.

Where the Stolen Funds Are Now

At November 4 prices, the addresses linked to the theft held $5.99 billion, or about 95% of the $6.31 billion stolen. Of that amount, $2.82 billion is frozen and $3.16 billion remains free: $1.45 billion in BTC, $1.40 billion in ETH and $303.6 million in XRP.

Balances at addresses linked to the theft as of November 4, 2026

Source: Global Ledger balance queries, with Polygon and Optimism data from Octav. Values use November 4 closing prices; shares refer to the total value held at the addresses covered.

The largest balances have barely been touched. Five wallets hold 81.1% of the free ETH, and almost all of the bitcoin remains where it was first placed. The XRP has changed wallets, but it has not yet been swapped or bridged. New swap proceeds continue to arrive at fresh addresses, so these balances will keep changing as tracing continues.

How the Funds Have Moved So Far

Global Ledger traced $1.28 billion sent from attacker wallets to outside counterparties between October 29 and November 4. The real total is likely to be higher, because this figure covers only selected tokens on Bitcoin, Ethereum, TRON and Avalanche. It does not include Solana or the XRP Ledger.

Traced outflows to counterparties, October 29–November 4, 2026

Source: Global Ledger entity reports. Shares refer to the $1.28 billion of traced outflows on the selected assets and networks described above. Values use arrival-day closing prices.

Swaps account for most of the traced outflows, with converted assets returning to attacker-controlled wallets. The attacker's priority in the first hours was to turn USDT and RLUSD, which issuers can freeze, into ETH and TRX, which they cannot. Attacker wallets received $1.18 billion in swap proceeds, including proceeds from tokens outside these figures.

Lending served a similar purpose. The attacker deposited 60 million USDT on Aave and borrowed about 19,762 WETH against it, converting a freezable asset into ether without selling it. After the liquidation on November 4, about $12.6 million of net value remains in that position.

Bridges received $176.6 million, and with centralized exchanges and mixers the total comes to about $180 million.

Among named services, SunSwap ($373.3 million) and Uniswap ($177.6 million) handled the largest amounts, followed by THORChain ($80.5 million), LI.FI ($50.2 million), Relay.link ($49.4 million) and Chainflip ($32.5 million). Another $360.4 million passed through swap contracts with no public label. These are protocols and services the attacker used, and their appearance here does not suggest any wrongdoing on their part.

Twelve Issuers Froze Stablecoins on Twelve Different Timelines

Stablecoin issuers did more than any other part of the industry to limit this theft. Between October 29 and November 3, 12 issuers made 132 freeze transactions covering 18 stablecoins, 36 wallets and five blockchains. USDT accounts for $1.77 billion of the frozen value and USDC for $824.7 million, with RLUSD, USD1 and smaller tokens making up most of the rest.

The table below records each issuer's first stablecoin freeze and its total freeze transactions and affected wallets.

Issuer freeze activity, October 29–November 3, 2026

*Includes USDT, USDT0 and USAT, as labelled in our data.

The table shows when each issuer acted. It does not show how much of that issuer's token the attacker held at the time, which for some may have been little or nothing, so a later freeze does not mean a slower response.

The share frozen differed widely from token to token. About 99.5% of the USDC was frozen, compared with around 68% of USDT and 46% of RLUSD. Issuer speed explains only part of this difference. Tether acted three minutes before Circle, but the attacker began with USDT, sending $842.6 million of it to counterparties, while only $4.0 million of USDC moved. RLUSD was frozen almost two hours after the first theft, by which time $48.0 million had gone.

A blacklist has to be applied token by token and chain by chain. The same address can operate across many blockchains, and each issuer has to act separately on each of them. The attacker's main receiving address was frozen 21 times by nine issuers over 99 hours. Tether's own products show the same pattern: USDT was frozen on Ethereum at 21:01 UTC, on Avalanche six minutes later and as USDT0 on Polygon more than two hours after that, while USAT on Avalanche followed on November 3. Issuers also work differently: Paxos froze four tokens in a single second, while StraitsX completed 42 transactions over about eight hours.

Later freezes served a different purpose. The last freeze that caught funds came at 13:36 UTC on October 30, and another 35 stablecoin freeze transactions followed it. Blacklisting a wallet with little or no balance restricts its subsequent use for that token. Such freezes do not recover funds from an empty wallet.

The GENIUS Act takes effect on January 18, 2027, and this case suggests that direct contact between issuers and investigators will remain important once the rules apply.

What Research on the Speed of Money Laundering Tells Us About This Case

The freeze record captures the immediate response. Global Ledger’s research into 255 hacks in 2025 provides context for both that response and the subsequent movement of funds. Binance is only six days in, so these comparisons are provisional.

First Movement and Laundering Timelines

After exchange hacks in 2025, funds took about 17 hours on average to make their first move. At Binance, stolen assets had reached a counterparty within 29 minutes. Funds also moved before public disclosure in 76% of hacks in 2025, rising to 84.6% in the second half of the year, so early movement of funds is common.

The laundering itself is at an early stage. In 2025:

• Stolen funds typically reached the first mixer or VASP about 5.2 days after the incident.
• Laundering averaged 10.6 days in the second half of the year, up from about eight days in the first.

Small amounts of the Binance funds reached those services within days. Earlier Global Ledger research found that larger hacks tend to move more slowly, so this theft may not follow the average.

How the Routes and Response Compare

Sources: Global Ledger’s Laundering Race research and the Binance tracing described in this article.

DeFi activity already exceeds the total recorded across all hacks in 2025. Most of the Binance swaps and lending activity formed part of the conversion into assets outside issuer control described above.

The role of bridges remains unresolved. In the Bybit case, 94.91% of stolen funds moved through bridges. Most of the Binance funds have not yet moved, so comparing final routing shares would be premature. The $3.16 billion still free exceeds all the funds that passed through bridges from the 255 hacks last year.

Centralized exchange inflows remain small. In 2025, the decline between H1 and H2 accompanied attackers’ reliance on longer routes. The Binance flows observed so far fit that pattern. They may also reflect the point made in our October 30 analysis of the Binance attacker’s laundering options: moving a sum of this size is far easier than turning it into usable money. Over-the-counter sales would not be visible on-chain, however, so the data cannot show the whole picture.

Freezing and Returning Funds

The much larger share frozen in the Binance case largely reflects how much of the theft involved stablecoins with active issuers.

Across 2025, 6.52% of stolen funds were returned, alongside the 9.52% frozen. How much of the frozen Binance funds will be returned remains a separate question and will depend on legal process.

The Binance Hack: Why It Matters

The balances still under attacker control and the routes used so far create continuing work for teams screening deposits and investigators pursuing the stolen funds.

For Compliance Teams

Most of the stolen funds have not yet reached the exchanges and other services that will have to screen them. When they do, they are unlikely to arrive directly from an address on a published list. Our High-Risk Benchmark found that hack-related exposure already sat 1.80 hops from exchanges on a value-weighted basis in 2025, and our laundering research found that once funds from a hacker-controlled address reach a VASP, compliance teams typically have 10–15 minutes to act.

That makes continuous rescreening and up-to-date attribution more important than a one-off check against the FBI's addresses. A deposit that looks clean today may be linked to the theft tomorrow, as new wallets are attributed. Teams should also treat a flagged address as flagged across every chain and token, and know how to reach each stablecoin issuer before they need to.

For Law Enforcement

The freezes show how much can be stopped in the first hour when issuers act quickly, and how much depends on which assets were stolen. Issuers have no such control over BTC, ETH or XRP, so the $3.16 billion still free can only be stopped when it reaches a point of intervention, such as a centralized exchange.

That is only possible if attribution is preserved across every wallet, swap and bridge.

Methodology

All figures are as of November 4, 2026, and all times are UTC. Counterparties come from Global Ledger entity reports on attacker wallets for BTC, selected ETH-based tokens, TRON and Avalanche. Balances come from Global Ledger queries of attacker addresses on seven chains, with Polygon and Optimism from Octav. The stolen total combines Global Ledger's count of $5.73 billion with $0.57 billion from Octav for smaller tokens and chains.

Stolen funds are priced at theft-day closes, counterparties at arrival-day closes and holdings at November 4 closes. Freeze data covers 132 on-chain transactions from October 29 to November 3. The share frozen compares frozen balances with amounts sent to counterparties. All figures may change as tracing continues.

Following the Funds Beyond the First Six Days

The first six days of the Binance hack show how the assets stolen shape both the emergency response and the investigation that follows. Issuer freezes restricted a substantial share of the proceeds, while conversions into assets outside issuer control left a large portfolio available for further movement. The next opportunities to intervene will depend on the routes those funds take.

For compliance teams, the findings support continued monitoring and rescreening as new wallets are attributed and deposits acquire additional context. Investigators need to preserve the connection to the theft through subsequent transfers and conversions, and coordinate with issuers and services when funds reach a point where action is possible.

Global Ledger's transaction monitoring and investigation tools help teams follow those movements, assess direct and indirect exposure, and document the paths behind an alert or investigation. The same analysis used to reconstruct this case supports the continuing work of identifying where stolen funds move next.