Four days after the October 29 theft, the funds stolen from Binance have started going through Bitcoin mixers for the first time: since November 1, about 28 BTC ($2.2M) has passed through 18 Wasabi-style coinjoins. A coinjoin pools many users' coins in one transaction and breaks the visible link between inputs and outputs.

The laundering so far spans about 12,000 wallets on 11 blockchains and more than 40,000 transactions. Most of it ran through Tron, where funds were split across about 7,700 addresses and bridged to Ethereum. ETH, SOL and NEAR began moving on November 1, and all 233 million stolen XRP moved to six new addresses early on November 2.

$2.85B, or 44% of the $6.43B stolen, is frozen or seized, against around 3% after the Bybit hack.

Around $3.24B still sits in linked addresses, mostly ETH and BTC, and only a negligible amount has likely been cashed out. The FBI has attributed the theft to North Korea's TraderTraitor group, and a similar path to Bybit is expected: ETH swapped for bitcoin, then cashed out through OTC brokers over months.