Binance Incident Tracks $6.34 Billion in Three Asset Buckets

By Elena Vasquez

How much is tied to the incident?

According to the incident update, a tracked pool linked to a Binance security incident contains $6.34 billion in assets, including roughly $2.85 billion still within the attacker's reach and about $2.6 billion in frozen funds.

The reported categories reconcile at the stated precision: $2.85 billion reachable plus $2.6 billion frozen equals $5.45 billion, while $6.34 billion minus $891 million also produces the same $5.45 billion balance after rounding.

Put differently, about 45% remains reachable, 41% is frozen, and 14% may have moved or been laundered. The percentages describe the tracked pool rather than a final loss calculation.

The update describes the $891 million as assets stolen during the incident. It does not describe the full $6.34 billion as stolen, and it does not provide a legal loss calculation.

Takeaway: The headline balances show where assets may sit, not how much has been recovered.

What happened through THORChain and Chainflip?

The incident update says the attacker moved funds through THORChain and Chainflip over a two- to three-day period. It provides no start or end date, sequence, amount handled by either protocol, transaction hash, or wallet address.

That omission prevents readers from calculating how much moved through each route or checking whether the two systems formed one continuous sequence. It also leaves open whether the activity consisted of direct transfers, conversions, or some combination because the update does not classify the transactions.

Operationally, tracing now depends on obtaining separate transaction records from both named protocols and their counterparties. Without those records, the summary cannot establish whether the routing served an evasion purpose or how any freeze interacted with it.

Takeaway: The route through two protocols expands the tracing burden, but the available figures do not quantify it.

What does the $891 million represent?

The $891 million figure combines possible transfers with possible laundering. The update supplies no separate amount for either component and offers no basis for assigning a precise split.

The wording “may have been moved or laundered” therefore matters. It prevents the category from serving as proof that all $891 million passed through a laundering process, or that none of it remains traceable.

Nor does the figure prove unavailability: the update does not say whether the assets remain monitored, frozen, recoverable, or held by a named entity. The category records uncertainty rather than a confirmed disposition.

The arithmetic also rests on rounded inputs, so the $5.45 billion balance should not be read to the dollar. Its value is directional, showing where the tracker places the remaining pool rather than providing a ledger-level reconciliation.

Takeaway: The $891 million is a broad combined estimate, not a proven laundering total.

What can be independently verified?

The update names Binance, THORChain, and Chainflip, but it identifies no court, regulator, law-enforcement agency, seizure warrant, affected account, or named investigator. It also omits the incident date and attack method.

Accordingly, its numbers function as a tracked estimate rather than a judicially established loss or recovery figure. Calling the $2.6 billion “frozen” establishes a reported restriction on use; it does not establish that the assets have been recovered or that a court ordered the restriction.

Likewise, “within the attacker's reach” does not identify a destination venue or prove that the attacker can readily convert the balance. Those distinctions require wallet-level evidence rather than summary labels.

Takeaway: Primary records, not summary arithmetic, will determine the actual loss and recovery position.

What should readers watch next?

The record sets no court deadline, enforcement window, or formal reporting timetable. The next useful disclosures are specific:

• A dated transaction ledger separating the $891 million between transfers and possible laundering, with transaction hashes and destination wallets.
• Protocol-level figures showing how much traversed THORChain and Chainflip, the order of movements, and the counterparties involved.
• The identity of the entity or entities responsible for freezing $2.6 billion, plus the legal or technical basis for each restriction.
• A clarification of whether $6.34 billion measures customer losses, assets linked to the incident, or a wider tracked pool.
• The incident date, attack method, and account or wallet scope affected.

Until those records appear, the strongest conclusion remains narrow: a reported $5.45 billion sits in reachable or frozen categories, while $891 million may have changed status through movement or laundering. The immediate enforcement question is whether further restrictions can reach the $2.85 billion before counterparties release or transfer it.

Takeaway: The next credible checkpoint is an itemized freeze record or transaction-level disclosure showing whether the $2.85 billion remains recoverable.