On October 29, 2026, about $6.36 billion reportedly left Binance wallets across ten blockchains, according to TRM Labs. After the initial transfers, the funds were traced through many wallets, while TRM investigator Nick Carlsen described Chinese laundering teams as handling nearly all later transactions.
For the intrusion itself, see NeoTeo’s earlier account of how attackers reached Binance’s transaction-signing service.
The reported route after the first transfers
The attackers reportedly tried to swap assets that issuers could freeze for cryptocurrencies beyond those issuers’ control. Carlsen described Chinese laundering teams as taking over after the initial transfers. He also said TRM had observed overlap with a Chinese network tied to earlier North Korean thefts.
The described cash-out routes included exchanging cryptocurrency for yuan through Chinese bank accounts, or obtaining access to bank accounts or payment cards. These are reported investigative assessments of the operation, not a route traced for every coin.
Wallet counts describe the scope of a tracing effort. They are not a single running total unless their periods and definitions match.
Why the wallet counts differ
An early estimate attributed to Elliptic put activity at about 12,000 wallets during the first three and a half days of laundering. Separately, Elliptic’s own account describes tracing funds across more than 20,000 wallets and 16 blockchains. The first figure has a defined early window; the broader one describes a wider tracing scope.
