Binance Hacker Mixes $2.2M in Bitcoin; $3.24B Still Tracked
The Binance hacker has routed about 28 BTC, worth roughly $2.2 million, through 18 CoinJoin transactions since Nov. 1, according to blockchain analytics firm Elliptic. The funds were converted from assets stolen in the Oct. 29 Binance breach; the 18,270 BTC stolen directly from the exchange remain in 19 addresses, the firm said.
Elliptic estimates that addresses linked to the theft still hold $3.24 billion in visible on-chain assets, while about $2.85 billion has been frozen or seized—roughly 44% of its estimated $6.43 billion theft total. The tracked balance does not prove who controls every wallet, and Elliptic said little appears to have been cashed out.
Binance says it is replacing stolen assets with company funds and had reached about 90% replenishment by Oct. 31. The exchange’s reimbursement effort is separate from investigators’ attempts to recover the funds. CoinJoin activity adds a laundering risk and may make tracing some converted Bitcoin more difficult, but the reported mixing volume is small compared with the total theft.
Neutral
The news is neutral for the broader crypto market, with a modest negative security and sentiment signal. The reported 28 BTC mixed—about $2.2 million—is small relative to the estimated $6.43 billion theft, and the directly stolen 18,270 BTC reportedly remain unmoved in 19 addresses. This limits evidence of immediate large-scale Bitcoin selling pressure. CoinJoin can complicate attribution, but mixing does not itself mean the funds have been sold.
In the short term, traders may watch for movements from known theft-linked wallets, exchange deposit activity, and any further freezes or seizures. Such signals can prompt brief volatility in BTC and related assets, especially if investigators or issuers disclose new developments. The large visible balance may also sustain concern about future selling or laundering, even though the article says little appears to have been cashed out.
Longer term, the incident reinforces exchange custody and illicit-finance risks, potentially weighing on confidence in centralized platforms. However, Binance’s reported 90% asset replenishment and the roughly 44% of the estimated theft frozen or seized may help contain fears of immediate customer losses or an uncontrolled market supply shock. As in previous major exchange hacks, the market response is likely to depend less on the headline amount than on whether stolen assets reach liquid markets and whether the exchange can meet customer obligations. On the facts reported, there is no clear directional catalyst for the wider market.