Statements

What the attacker keeps is what nobody can freeze. By Elliptic's count about 3.33 billion dollars sat in roughly 43 addresses: 511,861 ETH, 18,270 BTC, 233 million XRP and 670 million TRX, with about 445 million in XRP, SOL and NEAR that has not moved at all.

Swaps into THORChain use the same amounts again and again, with one value appearing 19 times.

The main Tron distribution wallet has sent funds every hour for 31 hours straight. The longest pause was 46 minutes, and there was no overnight break.

October 31, 22:41 UTC. About $196 million has been sent out of the main Tron distribution wallet to around 200 wallets,

Chainalysis said the incident is "not related to the recent crypto theft at Binance."

Blockchain analytics firm Chainalysis said an AI-assisted hacker breached its systems and accessed “non-sensitive” customer data, including names and emails.

“USDT is real money backed by dollars, and the position is criminal but overcollateralized in the eyes of the protocol.”

Cap value and rate per wallet at the signer and hold new destinations for a second approval

The pattern of transactions suggests that much of the laundering was carried out by software rather than by hand.

Whether the automation involves AI agents, rather than conventional scripts, cannot be determined from the on-chain data.

At current prices, the attacker now controls around $3.25 billion of assets that cannot be frozen by an issuer, spread across more than 800 addresses. This includes around 584,000 ETH ($1.32 billion), 18,327 BTC ($1.42 billion) and 233 million XRP.

The 18,270 BTC has been split through a short peel chain into 19 addresses, most holding 1,000 BTC each. None of it has yet been sent to a service.

On Tron, 234 million USDT was swapped for 638 million TRX on SunSwap. On Ethereum, 48 million RLUSD was sold before Ripple froze the remainder, and around 150 other tokens were dumped for ETH on decentralized exchanges.

A second attacker wallet deposited 59.9 million USDT into Aave as collateral and borrowed 19,762 ETH, before Aave froze the affected markets. The loan is still open and close to the point of liquidation.

On Ethereum, 434 million USDT was swapped for 160,451 ETH through Uniswap, 1inch and market makers' request-for-quote systems. The swaps implied a loss of 12% to 26% against the market price, suggesting the attacker was prioritizing speed over value.

Before the freezes landed, the attacker converted around $786 million of stablecoins into ETH and TRX.

On October 30, the attacker began moving funds between blockchains. Between 11:38 and 12:29 UTC, they sold all of the stolen AVAX for USDC, bridged it to Ethereum using Circle's Cross-Chain Transfer Protocol (CCTP), and swapped it for 7,242.8 ETH.

“Our investigators are observing never-seen-before laundering patterns with the stolen funds from the Binance exploit,” the company said . “Thousands of transactions in a short period suggest that the attackers are using automation to obscure the trail of funds.”

This repeated sequence suggests a programmatic process for moving and redistributing the stolen funds.

Many addresses follow a consistent pattern: they receive exactly 1 TRX, then receive additional funds, then forward funds to other addresses.

Over nearly 20 minutes it swapped $325 million in stablecoins into $285 million in ETH.

It now holds more than 420,000 ETH and 18,270 BTC, about USD 2.4 billion in assets beyond any issuer's reach.

From what I've read, DebugBear is related to the Polymarket hack, not Binance.

UPD: This is related to the Polymarket security incident, not Binance.

Concerns were first raised by blockchain researcher Spreek, who posted on X that assets from a Binance-linked Ethereum wallet had been transferred to a newly created address through a contract call allegedly funded by Tornado Cash.