Elliptic tracks $3.2B Binance haul moving through 11 chains in four days

The cash from the Binance theft is still in play — and it's moving in bulk. Elliptic says about $3.2 billion tied to the heist is parked in wallets connected to the hackers, who the analytics firm links to North Korea. Laundering crews are pushing that money across multiple networks at once.

The pace is brutal. In fewer than four days, activity hit roughly 12,000 wallets spread over 11 blockchains and racked up more than 40,000 transactions. On average, a fresh wallet popped up about every 25 seconds. Elliptic says that metronome-like rhythm and the batch processing behind it point to plain software automation, not an AI system making its own choices.

Tron is doing the heavy lifting. Funds were split across about 7,700 addresses there, and at least $147 million has already been bridged from Tron over to Ethereum.

The rotation widened on Nov. 1, when Ether (ETH), Solana (SOL), NEAR and XRP started moving. In a first, about 28 Bitcoin (BTC) — worth roughly $2.2 million — landed in a Wasabi-style coinjoin mixer, a step up in obfuscation for this operation.

For all that churn, the confirmed proceeds actually cashed out so far are negligible. Most of the money is still bouncing between wallets, and Elliptic's mapping suggests the trail is far from cold.