Binance Hacker Moves $2.2M in Stolen Bitcoin Through CoinJoin to Obscure Funds

TL;DR

• Approximately 28 BTC, worth $2.2 million, entered 18 CoinJoin transactions between November 1 and November 2.
• Elliptic continues to track $3.24 billion in assets linked to the October 29 Binance theft across multiple blockchains.
• Binance has allocated more than $6.34 billion in company resources to replace affected assets, while blockchain investigators monitor movements.
  

  ---

The attacker behind the October 29 Binance theft has started using Bitcoin privacy tools to complicate the tracking of funds. Blockchain analytics firm Elliptic identified approximately $2.2 million in Bitcoin moving through CoinJoin transactions, while billions of dollars in assets remain visible across public blockchain networks.

The activity illustrates how sophisticated cryptocurrency transactions can make investigations more challenging without eliminating the transparency built into blockchain technology. Despite the use of privacy protocols, investigators continue to follow transaction patterns and identify connections between addresses.

Binance Hacker Uses CoinJoin To Complicate Bitcoin Tracking

According to Elliptic’s November 2 investigation, the first identified mixing activity occurred at 05:55 UTC on November 1. Approximately 28 BTC subsequently passed through 18 CoinJoin transactions by 06:02 UTC on November 2.

The Bitcoin originated from assets converted following the original theft. Investigators identified transactions using WabiSabi, a protocol associated with Wasabi Wallet that allows multiple participants to combine their Bitcoin into shared transactions.

This approach makes it harder to establish which outgoing coins correspond to particular incoming funds. However, CoinJoin does not remove transactions from the blockchain or make Bitcoin completely untraceable. Researchers can still examine transaction structures, timing and connections with previously identified addresses.

Elliptic’s investigation covers approximately 12,000 wallets, 11 blockchains and more than 40,000 transactions. The firm also reported that the 18,270 BTC stolen directly from Binance remained distributed across 19 addresses without further movement.

The distinction matters because the Bitcoin entering CoinJoin represents converted assets rather than direct transfers from those original Bitcoin holdings.

Billions Remain Visible As Recovery Efforts Continue

Elliptic estimated that approximately $3.24 billion in theft-linked assets remained in identifiable addresses. Its earlier assessment valued the October 29 incident at $6.43 billion, with approximately $2.85 billion in frozen or seized assets.

Stablecoins accounted for 94% of the restricted funds, demonstrating how issuer-controlled digital assets offer additional intervention mechanisms. Tether and Circle can restrict certain tokens, while decentralized networks generally require different approaches to address illicit activity.

This difference highlights an important feature of cryptocurrency infrastructure. Bitcoin transactions remain publicly verifiable, but native assets cannot simply be frozen by a private issuer. That distinction gives blockchain investigators a permanent transaction record while preserving the decentralized properties of networks such as Bitcoin.