Independent record. Not associated with, endorsed by or operated by Binance. This site is read-only: there is nothing to sign in to, pay for or connect.

The Binance Hack

An independent record of the October 2026 Binance hack

Attack reconstruction: Laundering

Back to the overview · Previous stage: Consolidation

The claims placed under one stage of the attack, each with its source. The quote, the capture time and the hash of the stored copy are on the statement page that each line links to. Which stage a claim sits under is chosen by keywords in its one-line summary, so it is a reading aid and not a finding.

21 approved claims under this stage.

Laundering

Conversions, swaps, bridges and distribution after the transfers, as described by the analytics firms that traced them.

  1. Reported amount

    Cointelegraph reported that CertiK engineer Dickson Wu traced $500 million in USDT that was sent to one address, with $325 million sold to market makers for ETH by 20:59 UTC, less than an hour after the hack began.

    Timeline row: Cointelegraph reported CertiK traced $500M USDT to one address, with $325M sold to market makers for ETH by 20:59 UTC

    Dickson Wu, Cointelegraph. Original Statement 388 Captured .

  2. Reported other

    Cointelegraph reported that Chainalysis said its investigators were observing never-seen-before laundering patterns with the stolen funds.

    Chainalysis, Cointelegraph. Original Statement 130 Captured .

  3. Reported other

    Elliptic said that on October 30 the attacker sold all stolen AVAX for USDC between 11:38 and 12:29 UTC, bridged it to Ethereum using Circle's CCTP, and swapped it for 7,242.8 ETH.

    Timeline row: Elliptic said the attacker began moving funds between blockchains, selling stolen AVAX for USDC from 11:38

    Elliptic, Elliptic. Original Statement 100 Captured .

  4. Reported amount

    Elliptic indicated that approximately $31 million has been swapped into THORChain at a rate of roughly 100 swaps every two hours since midnight.

    Elliptic, Elliptic. Original Statement 718 Captured .

  5. Official recovery

    Binance said in Recovery Update #3 that it will continue to buy the remaining relevant token assets through market and OTC channels until the covered amount reaches 100% for all tokens.

    Binance. Original Statement 728 Captured .

  6. Reported other

    Elliptic said at 22:41 UTC on October 31 that about $196 million had been sent out of the main Tron distribution wallet to around 200 wallets.

    Timeline row: Elliptic said about $196M had been sent out of the main Tron distribution wallet to around 200 wallets

    Elliptic, Elliptic. Original Statement 199 Captured .

  7. Reported amount

    Elliptic reported that approximately $196 million was sent from the main Tron distribution wallet to around 200 wallets, with the wallet being topped up in batches of about $40 million.

    Elliptic, Elliptic. Original Statement 713 Captured .

  8. Reported amount

    Elliptic said that, as of 22:41 UTC on 31 October 2026, the largest routes for funds traced from the main distribution wallets were THORChain ($31 million), SunSwap ($5.3 million), Bitget Swap ($1.8 million) and USDT0 ($0.4 million).

    Elliptic, Elliptic. Original Statement 719 Captured .

No time stated

  1. No time stated
    Reported other

    Elliptic said 434 million USDT was swapped for 160,451 ETH on Ethereum at a loss of 12% to 26% against the market price, which it read as the attacker prioritising speed over value.

    Elliptic, Elliptic. Original Statement 96 Captured .

  2. No time stated
    Reported other

    Elliptic said the 18,270 BTC was split through a peel chain into 19 addresses, most holding 1,000 BTC each, and that none of it had yet been sent to a service.

    Elliptic, Elliptic. Original Statement 99 Captured .

  3. No time stated
    Reported other

    Chainalysis said many addresses receive exactly 1 TRX, then additional funds, then forward the funds, which it said suggests a programmatic process.

    Chainalysis, Chainalysis. Original Statement 195 Captured .

  4. No time stated
    Reported other

    Elliptic said the main Tron distribution wallet had sent funds every hour for 31 hours straight, with a longest pause of 46 minutes and no overnight break.

    Elliptic, Elliptic. Original Statement 196 Captured .

  5. No time stated
    Reported other

    Elliptic said swaps into THORChain use the same amounts repeatedly, with one value appearing 19 times, which it read as evidence of software-driven laundering.

    Elliptic, Elliptic. Original Statement 197 Captured .

  6. No time stated
    Reported other

    Chainalysis said that this repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

    Chainalysis, Chainalysis. Original Statement 296 Captured .

  7. No time stated
    Reported othersays something is unexplained

    Elliptic said whether the laundering automation involves AI agents rather than conventional scripts cannot be determined from the on-chain data.

    Elliptic, Elliptic. Original Statement 304 Captured .

  8. No time stated
    Reported other

    Elliptic said the pattern of transactions suggests much of the laundering was carried out by software rather than by hand.

    Elliptic, Elliptic. Original Statement 305 Captured .

  9. No time stated
    Reported other

    Marc Zeller, founder of the Aave Chan Initiative, said USDT is real money backed by dollars and that the position is criminal but overcollateralized in the eyes of the protocol.

    Marc Zeller, Cointelegraph. Original Statement 394 Captured .

  10. No time stated
    Reported amount

    Bitquery added that the attackers initially stole 200,630 ETH and accumulated the rest by swapping stolen stablecoins and other tokens.

    Bitquery, Cointelegraph. Original Statement 497 Captured .

  11. No time stated
    Reported recovery

    Chainalysis stated that the attackers in the Binance hack are using automation to obscure the trail and leveraging DeFi protocols on Tron to avoid stablecoin freezes.

    Chainalysis, The Block. Original Statement 524 Captured .

  12. No time stated
    Reported other

    Elliptic observed that transfers from the main distribution wallet are almost never less than about 30 seconds apart, and the roughly 200 wallets it pays typically pass funds on within about two minutes.

    Elliptic, Elliptic. Original Statement 715 Captured .

  13. No time stated
    Reported other

    Elliptic stated that when a bridge rejected deposits, the funds were automatically re-sent to the same destination from new wallets.

    Elliptic, Elliptic. Original Statement 717 Captured .