The hackers responsible for the $6.3 billion Binance cryptocurrency theft on October 29, 2026, have spread the stolen funds across more than 10,000 digital wallets. According to a Wall Street Journal investigation published on November 7, 2026, the attackers used cryptocurrency services to move and obscure the money trail, despite efforts by blockchain companies and law enforcement to freeze the assets.
Blockchain analytics firm Chainalysis found that over $46 million in stolen assets passed through THORChain within the first 72 hours after the attack, generating more than $200,000 in fees for the service's operators. Nearly $4 million was also routed through Wasabi Wallet, a Bitcoin privacy service designed to make transactions harder to trace.
A separate investigation by blockchain intelligence firm Bitquery traced approximately $333 million in stolen cryptocurrency that was laundered or moved towards cash-out services during the first week after the breach. The researchers found that about $208 million moved within the first two and a half days, with THORChain identified as a major route for approximately $113 million.
While stablecoin issuers and other organizations have frozen a substantial portion of the stolen cryptocurrency, the Journal reported that approximately half of the stolen funds had been frozen. However, blockchain tracing firms estimated that the attackers still controlled nearly $3 billion. Freezing cryptocurrency can prevent it from being transferred, but it does not necessarily mean the assets have been returned to Binance or their rightful owners.