Binance Hackers Launder Stolen Bitcoin Through CoinJoin
TREE NEWS reports: Approximately 28 bitcoins (BTC), valued at around $2.2 million, linked to the recent Binance hack have been moved into Bitcoin mixing transactions, marking the first time stolen funds from the exchange have entered a CoinJoin mixing service. Since November 1, these funds have been processed through 18 separate CoinJoin transactions.
The bitcoin used in these mixing transactions originally came from stolen funds on the Tron blockchain, Elliptic noted. Some of the ether (ETH) that had been sitting in addresses was also converted into bitcoin and flowed into the mixing transactions.
The directly stolen 18,270 BTC have been dispersed across 19 addresses and have not moved since. Elliptic reported that within four days of the theft, the related funds traveled through approximately 12,000 wallets across 11 blockchains, involving over 40,000 transactions. The associated addresses still hold about $3.24 billion in assets, while another $2.85 billion has been frozen or seized.
Analysis: A Complex Laundering Operation
The use of CoinJoin — a privacy-enhancing technique that combines multiple bitcoin transactions to obscure the trail — signals that the attackers are actively trying to obfuscate the origin of the funds. This is a common tactic among sophisticated cybercriminals, but it also presents challenges for law enforcement and exchanges that monitor for illicit activity.
The fact that the stolen funds originated on Tron and were bridged to Bitcoin highlights the cross-chain nature of modern crypto crime. Attackers are increasingly using multiple blockchains to layer their transactions, making it harder for investigators to follow the money. The conversion of ETH to BTC further complicates tracing efforts.
Elliptic’s data shows that the attackers have been moving funds rapidly across a wide network of wallets. The sheer volume — 12,000 wallets and 40,000 transactions in just four days — indicates a highly organized operation, possibly involving automated scripts to disperse funds.
Implications for Exchanges and Regulators
The Binance hack, one of the largest in crypto history, has put a spotlight on exchange security and anti-money laundering (AML) practices. The movement of funds into mixers will likely intensify calls for stricter regulation of privacy coins and mixing services. Regulators in the US and Europe have already been cracking down on anonymity-enhancing technologies, and this incident may accelerate those efforts.
Exchanges will need to enhance their blockchain monitoring capabilities to detect and block funds tied to the hack. Binance has been cooperating with law enforcement and has offered a bounty for information leading to the arrest of the perpetrators. The frozen assets suggest that some exchanges and stablecoin issuers have already taken action to block the stolen funds.
Forward-Looking Perspective
The coming weeks will be critical in determining whether the attackers can successfully launder the stolen bitcoin. CoinJoin transactions do not make funds completely untraceable, and analytics firms like Elliptic are continually improving their ability to deanonymize such flows. However, the cross-chain and multi-wallet approach shows that criminals are adapting.
For the crypto industry, this incident underscores the need for better collaboration between exchanges, analytics firms, and law enforcement. It also raises questions about the effectiveness of current AML regulations in a decentralized, cross-chain environment. As the investigation unfolds, the industry will be watching closely to see if the stolen funds can be recovered and whether new regulatory measures are introduced.
