Binance Theft Trail Spans 36 Services, 16 Blockchains

By Elena Vasquez

A tracing review of on-chain records found that about $2.85 billion in assets stolen from Binance had been frozen or seized by Nov. 7, while roughly $3.13 billion remained in addresses linked to the theft. The remaining pool consisted mostly of Bitcoin (BTC) and Ether (ETH), according to the Nov. 7 snapshot.

How far did the stolen funds travel?

The review traced the assets through at least 36 services across 16 blockchains. More than 20,000 wallet addresses and about 65,000 transactions formed the observed trail. This is a transaction-chain snapshot, not a complete account of every participant or intention.

The funds were split and routed through four categories:

• Cross-chain bridges
• Decentralized exchanges
• Lending protocols
• Mixing services

The sequence matters operationally because splitting and transferring assets across multiple services can make origin tracing harder. The source names none of the 36 services and does not allege that any knowingly assisted; it documents their place in the money-moving path.

In plain terms, the trail records extensive fragmentation, not equal responsibility among every service.

How much was frozen, and what remained?

About $2.85 billion in stolen assets had been frozen or seized by the cutoff. Roughly $3.13 billion remained in linked addresses, predominantly Bitcoin and Ether. The main BTC and ETH holdings had not moved as of Nov. 7.

Those figures distinguish assets subject to a freeze or seizure from those still sitting in addresses tied to the theft. The review provides no valuation date, original loss figure, legal mechanism, or agency attribution.

A separate portion of the stolen assets, valued at about $175 million, had been converted into roughly 2,300 BTC. The review treats that conversion as distinct from the larger main BTC and ETH holdings that remained unmoved at the cutoff.

That distinction prevents the 2,300 BTC figure from being read as the full Bitcoin balance associated with the theft. Without transaction identifiers or wallet-level evidence, the summary does not allow independent valuation or verification of the conversion.

In plain terms, the review shows substantial freezes or seizures while a larger dollar pool remained linked to the theft.

What happened to SOL and XRP?

All stolen Solana (SOL) had been moved or converted by Nov. 7. Some XRP had also been swapped into BTC.

Neither statement specifies the amount converted, destination, venue, or whether either conversion recovered funds for victims or authorities. Changing an asset’s form can also create a new tracing path, leaving investigators to connect activity across different blockchains.

The source therefore supports a description of movement, not a conclusion about recovery. The cross-chain conversion leaves the loss open unless the receiving assets are separately frozen or seized.

In plain terms, the original SOL exposure had changed form, while the XRP conversion remained only partly quantified.

What does the snapshot establish?

The summary supports three firm findings: the route covered at least 36 services, the observed trail exceeded 20,000 addresses and 65,000 transactions, and the frozen-or-seized pool reached about $2.85 billion. It also records roughly $3.13 billion still linked to addresses.

Several important details remain absent. The source does not identify law-enforcement agencies, jurisdictions, seizure instruments, legal bases, or the disposition of frozen and seized assets. It also provides no address list, transaction identifiers, valuation methodology, original theft value, or year for the Nov. 7 cutoff.

Without those details, the figures cannot establish a final recovery percentage or show whether the assets had been returned. The evidence documents a large partial response, not a finished accounting.

The next verifiable checkpoint is whether the $3.13 billion linked pool moves, faces additional freezes or seizures, or changes form after Nov. 7. Until then, the available record does not support treating the Binance theft as closed.