Two Crypto Theft Cases Show Similar Paths for Stolen Funds

Two crypto thefts less than a week apart appear to share a pattern: move quickly out of stablecoins that issuers can freeze, split the funds, transfer them across blockchains and then use privacy coins or over-the-counter channels to make tracing harder. The amount of stablecoins frozen—and the ETH and BTC still under attackers’ control—matters both for recovery prospects and for gauging potential future selling pressure.

Stablecoin freezes followed the Binance hot-wallet theft

On October 29, attackers moved about $6.36 billion in assets from Binance hot wallets across several blockchains. Hot wallets are internet-connected wallets that exchanges use to handle operations such as customer withdrawals. Blockchain analytics firm TRM Labs said most of the funds were moved within about 20 minutes. The FBI attributed the attack to North Korean hacking group TraderTraitor. It is the largest known crypto theft to date.

Stablecoin issuers can freeze tokens held in specific wallets, making USDT and USDC vulnerable to seizure. TRM said Tether froze about 971 million USDT in the attackers’ receiving wallets roughly 37 minutes after the main funds arrived. Circle later froze about 823 million USDC. Including actions by Tether, Circle, Ripple, World Liberty Financial and the Arbitrum Security Council, TRM estimated that about $2.7 billion was frozen. Binance put the figure at about $3 billion.

To avoid further freezes, the attackers sold about 325 million USDT to market makers for roughly 122,300 ETH. The trade cleared at a discount of more than 10% to the market price at the time. They also deposited about 60 million USDT as collateral on lending protocol Aave and borrowed about 19,760 ETH. Trading at a steep discount to move into assets that issuers cannot freeze directly points to the urgency of the attackers’ response to the freeze risk.

Bitcoin split into smaller transfers as funds crossed chains

Once converted into assets such as ETH and BTC, which cannot be frozen directly by issuers, the funds became harder to trace. TRM said the 18,270 BTC moved from Binance were split within the same block into multiple transfers of 1,000 BTC and 100 BTC, creating a series of smaller trails. Investigators also found funds moving automatically back and forth between multiple wallets, including previously used addresses, potentially complicating the tracing effort.

Cross-chain bridges can move assets from one blockchain to another, requiring investigators to follow them on a new network. Blockchain monitoring firm Onchain Lens said that in another suspected case disclosed on Monday, funds from a wallet linked to King, a Solana arbitrage bot, passed through several Solana wallets before moving to Ethereum via the Mayan cross-chain service. King’s operator has not confirmed a breach, so the route alone does not establish that the bot or a related party was compromised.

TRM said early transfers in the Binance case relied more on market makers and lending protocols than on cross-chain bridges, which featured more prominently after the $1.5 billion Bybit theft in 2025. It expects bridges, exchange services and over-the-counter brokers could also be used as the Binance funds continue to move.

EU-linked accounts may have lost more than $106 million

Blockchain investigator ZachXBT said on Monday that an unidentified EU entity may have been robbed on Sunday, with losses exceeding $106 million across multiple exchange accounts. The alleged victim and exchanges involved have not been named, and the case remains unconfirmed. ZachXBT said the funds were transferred in USDC and USDT, with the USDC converted into ETH—a sequence resembling the early stages of the Binance case.

ZachXBT also said the funds passed through instant-exchange services including WellWallet and Kyrrex before being converted into Monero through a service called Wagyu. Instant exchanges allow users to swap tokens quickly. Monero, by default, conceals the sender, recipient and transaction amount. Once funds enter Monero, tracing them through public blockchain records becomes substantially more difficult.

Remaining balances could affect potential market supply

TRM said the Binance attackers still controlled more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion combined. These assets are not directly subject to stablecoin issuers’ freeze mechanisms. If large amounts of ETH or BTC eventually reach the market, they could add to available supply. But the timing and route of any sales are unknown; transfers could be spread over weeks or months, so the balances do not establish that a concentrated sell-off is imminent.

Binance co-CEO He Yi said the exchange had allocated more than $6.34 billion in company funds to cover the stolen assets. The arrangements reportedly include purchases through over-the-counter trades and exchange transactions, which could create demand on the other side of the market. The scale, timing and execution of those purchases remain relevant to assessing the flow of funds.

Binance has said it will absorb the loss, and customers have not been told they will bear it. The incident involved the exchange’s own hot wallets, but still highlights that the security of assets held on a trading platform depends on the platform’s safeguards. Stablecoin freezes helped restrict the movement of stolen funds in this case, while also demonstrating that issuers can control tokens in specific wallets.

Wallet movements and freeze totals remain key indicators

Investigators will be watching for large transfers from the attackers’ ETH and BTC wallets, particularly movements toward exchanges or over-the-counter channels. TRM is tracking the split transfers and wallets where funds are consolidated. Large movements could indicate that stolen assets are nearing a sale, although a transfer alone does not mean the funds have been cashed out.

Binance has not disclosed the full cause of the compromise involving its signing system. A detailed explanation of the security failure will inform assessments of whether other platforms face similar risks. The suspected EU case also awaits confirmation from the victim, exchanges or a verified loss figure; until then, the reported amount of more than $106 million remains an unconfirmed estimate. Any updates to frozen or recovered funds would also change estimates of how much the attackers still control.