Alleged Binance Theft Funds Passed Through THORChain, Chainflip

About $2.85 billion in funds linked to an alleged Binance theft remains under suspected hackers’ control, while roughly $2.6 billion has been frozen and an estimated $891 million may have been moved or laundered. The figures in the update place the reported total at about $6.34 billion.

THORChain and Chainflip, both cross-chain protocols, carried transfers tied to the alleged theft over the two to three days before Nov. 10. At the time of the update, neither protocol had restricted activity from the wallets linked to the funds.

How is the $6.34 billion divided?

The accounting separates the potentially moved or laundered balance from funds that remain under suspected control or have been frozen:

• An estimated $891 million may have been moved or laundered.
• About $2.85 billion remains under suspected hackers’ control.
• Roughly $2.6 billion has been frozen.
• About $5.45 billion remains outside the moved-or-laundered category, covering the controlled and frozen balances.

Together, the three headline amounts account for the reported $6.34 billion, with figures rounded. About 86% of the total sits outside the potentially laundered category. The $891 million estimate is roughly one-third of the frozen balance and about 14% of the reported total.

The distinction between the first category and the others is substantive. The update describes $891 million as funds that may have been moved or laundered, not as a conclusively established final destination. It also keeps that amount separate from the assets already frozen, so the categories should not be combined into a single loss estimate.

The material does not identify the party or agency responsible for the freezes, a court filing or law-enforcement action behind them. That leaves the enforcement provenance unspecified even though $2.6 billion is already recorded as frozen.

What happened at THORChain and Chainflip?

The two protocols served as cross-chain routes for the transfers during a two-to-three-day window before Nov. 10. The update does not assign the $891 million estimate between them, so the figures should not be read as a protocol-by-protocol breakdown.

At the time of the update, neither THORChain nor Chainflip had restricted activity from the wallets linked to the funds. Operationally, the movement did not coincide with a reported protocol-level restriction on the relevant wallets.

That limits what can be inferred from the transfer alone. The report does not show that passage through either protocol generated a cutoff for the linked wallets, and the source describes no subsequent restriction. It documents a movement route rather than a completed protocol-level enforcement outcome.

What does this change for cross-chain users?

For users and institutions active on THORChain or Chainflip, the practical change is narrow but material: routing through either protocol did not, by itself, trigger a restriction on wallets associated with the alleged Binance theft. Operators cannot assume that the appearance of a cross-chain transfer proves a protocol stopped further movement.

The unresolved $891 million estimate remains material because it equals roughly one-third of the frozen amount and may already have moved or been laundered rather than frozen. That figure represents the portion of the reported total outside the confirmed freeze.

The larger remaining balances carry different implications. The $2.6 billion is frozen, while $2.85 billion remains under the suspected hackers’ control.

With no enforcement deadline specified in the update, the next checkpoint is whether either protocol restricts the linked wallets or whether additional balances move into the frozen category and reduce the $2.85 billion under suspected control.