Binance Hackers Move Funds Through About 20 Services, THORChain’s Halt Slows Them and Binance Sees a $3.64 Billion Net Outflow

Three days after Binance reopened withdrawals, the picture is of a fast laundering operation, a pause that may have slowed it and a large but orderly outflow.

Blockchain analytics firm Elliptic says the hackers used roughly 20 automated services in under three days, moving funds through DEXs, lending protocols and cross-chain bridges. CoinDesk reports that Elliptic found no evidence that AI directed the activity, since repeated transfers, reused amounts, resent failed transactions and small test transfers point to human-supervised scripts. Crypto Insiders adds that Elliptic counted 1,113 transactions from the main wallet in just over two days, with a median pause of about 1.5 minutes. About $2.85 billion, or 44%, has been frozen or seized, while the hackers still control about $3.28 billion across more than 950 wallets. Stablecoin issuers can freeze funds, but native assets such as bitcoin and XRP cannot be stopped that way.

On Saturday, THORChain node operators paused swaps on ten networks, including Bitcoin, Ethereum, Solana and Tron, after a one-block Ethereum reorg removed a 10 ETH deposit that had already been credited. A refund against funds the vault never received triggered an automatic pause. Chainalysis said the pause may have inadvertently slowed the movement of stolen funds, while THORChain’s founder warned against shutting the protocol down under pressure.

For Binance, withdrawals restarted at 06:00 UTC on Sunday. In the first 9.5 hours it processed $4.649 billion in withdrawals against $1.01 billion in deposits, a net outflow of $3.64 billion. DefiLlama counted more than $6 billion leaving over 24 hours, about 3.6% of the $171 billion held before the attack, though that figure can include internal transfers. OKX and Bybit saw net inflows of about $450 million and $134 million, but public data does not show how much came from Binance customers.

Track the market yourself with AiTraderView’s FREE tools: Crypto Cockpit for charts and 75+ indicators, Crypto Screener to find setups, and Crypto Portfolio to follow your holdings. Just create a FREE account and try them yourself!

Sources:

• CoinDesk: No proof of AI in North Korean hackers move of stolen Binance funds
• CoinDesk: Live updates, Binance records $6 billion outflows after starting withdrawals
• Cointelegraph: THORChain halts swaps after block reorg bug, slowing Binance hackers
• Crypto Insiders: Binance-hackers proberen gestolen crypto razendsnel weg te sluizen