Binance Hacker May Have Laundered $891M; $2.6B Now Frozen

Roughly $891.37 million of the $6.34 billion stolen in the Binance hack may have already been moved off-platform or laundered, according to on-chain analytics firm Onchain Lens. The firm reported the figure on Nov. 10, based on its tracking of the attacker's wallet activity across cross-chain swap protocols.

The estimate marks the first detailed breakdown of where the stolen assets stand. The attacker currently has access to about $2.85 billion, while another $2.6 billion has been frozen. Together, those two amounts account for approximately $5.45 billion of the total haul — leaving the remainder either moved, laundered or otherwise unaccounted for.

How is the attacker moving the funds?

Onchain Lens said the hacker has been actively transferring assets over the past two to three days through THORChain and Chainflip, two cross-chain trading protocols that let users swap assets across different blockchains. Those protocols have become the primary escape routes for the stolen funds.

The concern now is scale. Onchain Lens raised the possibility that the attacker could move as much as $1 billion more before THORChain and Chainflip impose restrictions on transactions tied to the relevant wallets. Every hour without protocol-level curbs extends the window for the funds to fragment across chains.

What remains unconfirmed?

The laundering figure carries an important caveat. Onchain Lens acknowledged it has not been confirmed whether all of the estimated $891.37 million in moved assets has actually been laundered. On-chain transfer records alone make it difficult to determine the funds' final destination or whether the laundering process is complete.

That distinction matters for recovery efforts. Frozen assets can potentially be clawed back through legal and exchange cooperation; funds that have passed through cross-chain swaps and dispersed across multiple networks are far harder to trace.

What happens next?

Two variables will shape the outcome. The first is the attacker's own behavior — any additional large transfers reduce the recoverable pool. The second is the response of THORChain and Chainflip: transaction restrictions on wallets linked to the hack could slow the outflows, but they could also complicate tracing by pushing the attacker toward less transparent routes.

Onchain Lens warned that both additional transfers and protocol-imposed curbs could affect the ability to trace and recover the stolen funds. The next practical checkpoint is whether THORChain and Chainflip move to restrict the attacker's wallets before another $1 billion crosses the chain boundary.

By Daniel Okafor for Mempool Brief.