The largest single theft in history unfolded on October 29, 2026, when hackers stole $6.3 billion in cryptocurrency from Binance, the world’s largest exchange. The FBI has attributed the attack to North Korea’s TraderTraitor hacking group. However, turning stolen digital assets into spendable cash presents a formidable challenge. Cryptocurrencies like Bitcoin and Ether leave a permanent, publicly accessible trail on blockchains, allowing investigators to track movements even if they can’t immediately identify the thieves.
Some cryptocurrencies, such as Tether, can be frozen by their issuing companies. Within 37 minutes of the theft, Tether had frozen over $1 billion in stolen tokens. By November 1, approximately $2.85 billion, 44% of the stolen amount, had been frozen or seized. Binance has been replenishing customer losses using its own reserves, covering about 95% of the stolen assets by November 1. However, recovering the stolen funds from the hackers remains an ongoing investigation.
The hackers faced a dilemma: while their fortune was enormous, parts of it could be rendered unusable if not moved quickly. Investigators documented the attackers exchanging stolen tokens for other cryptocurrencies, often at a loss of 12% to 26% against market prices. The rapid movement of funds across multiple wallets, sometimes within seconds, complicated efforts to trace the stolen assets. Specialist firms use software to link suspicious wallets and alert cryptocurrency businesses when stolen assets approach their services.
To obscure the origins of the stolen funds, criminals have used blockchain bridges and cryptocurrency mixers. Bridges allow assets to be transferred between different blockchain networks, while mixers combine funds from multiple users before redistributing them. These methods complicate investigations but do not make stolen cryptocurrency untraceable. The central question remains whether the criminals can obtain lasting value from their stolen fortune despite the financial trail they leave behind.