Binance Hacker Moves First $2.2M of Stolen Bitcoin Into Mixing Service

The individual who looted a cryptocurrency exchange has begun using a technical tool to obscure the trail of a small portion of the theft, blockchain analytics firm Elliptic reported. The attacker moved 28 BTC, valued at roughly $2.2 million, into coinjoins—a mixing service that blends various users’ assets to make individual transactions harder to trace—marking the first time the perpetrator has used this method for the haul.

Of the $6.43B total stolen from Binance, about 44% or $2.85B has been frozen or seized. The remaining $3.24B is spread across more than 12,000 wallets and 11 blockchains, with the Tron network serving as a primary route. While about $16M was sent to addresses associated with a previous Bitget hack, Elliptic noted that very little of the overall stolen capital has been cashed out.

How we got here

Binance exchange hack response and asset-freeze recovery

All stories

How it could play out

−0.1%Impact on the S&P 500 across 4 scenarios (−0.1% to +0.1%)

Each figure is the modeled move of the S&P 500 if the outcome occurs. For information only. Not investment advice.

How it could play out

Portfolio

S&P 500

Story, how it could play out

4 ways this could read

Possible futures, not reported news · chances and moves from Tilt’s model

−0.1%
Laundering Accelerates
The most likely path is that the North Korea-linked operator continues laundering the stolen bitcoin in small batches to avoid exchange freezes and blockchain surveillance triggers. The $2.2 million transfer is probably a test transaction before larger rotations through mixers, peel chains, and over-the-counter brokers.
Finance −0.3% · Technology −0.1%
+0.1%
Enforcement Containment
U.S. authorities and major exchanges respond quickly by labeling wallets, blocking deposits, and warning over-the-counter desks. This would not reverse the hack, but it could reduce the attacker’s near-term ability to convert stolen BTC into spendable funds.
Finance +0.3% · Technology +0.1%
−0.1%
Binance Confidence Test
The market focus shifts from the hacker’s wallet movements to Binance’s solvency, insurance arrangements, and operational controls. Even if customer assets are covered, the continued movement of stolen funds could keep withdrawal pressure and regulatory attention elevated.
Finance −0.4% · Technology −0.1%
−0.1%
Sanctions Escalation
Because the FBI has attributed the hack to North Korea, continued laundering could trigger a sanctions-focused response rather than only a crypto-enforcement response. This scenario is less likely in the next few days, but it would raise the political cost for mixers, brokers, and exchanges that fail to screen funds.
Finance −0.3% · Technology −0.1%

Each figure is the modeled move of the S&P 500 if it happens. For information only. Not investment advice.

Looking for more context or analysis?