- Laundering stolen crypto at scale typically involves spreading funds across many blockchains and thousands of intermediate wallets to obscure their original source
- Mixing services, which pool many users’ funds together to break the on-chain link between a deposit and a withdrawal, remain a core tool despite covering only a small fraction of the Binance hack’s total proceeds so far
- Some assets, particularly ether and the NEAR token in the Binance case, have seen very little movement, suggesting hackers sometimes choose to simply wait rather than risk moving funds that are being closely watched
When a large sum of cryptocurrency is stolen, converting it into usable, spendable value without getting caught is often a longer and more difficult process than the theft itself. Elliptic’s tracking of the roughly $6.43 billion stolen from Binance illustrates the scale of effort this can require: more than 20,000 wallets, 16 separate blockchains, and over 36 distinct services have all been drawn into the laundering effort, spread across more than 65,000 individual transactions.
The basic logic behind spreading stolen funds across so many wallets and chains is to break the simple, traceable link between the original theft and wherever the funds eventually surface as spendable value. Each additional hop, whether a swap from one asset to another, a bridge from one blockchain to a different one, or a transfer through an intermediary wallet, adds a small amount of obfuscation, and doing this at a large enough scale can make full reconstruction of the money trail significantly harder, even when it remains possible with enough analytical effort.
Mixing services represent a more deliberate and concentrated obfuscation tool within this broader process. Rather than relying on volume and complexity alone, a mixing service pools funds from many different depositors together and pays out withdrawals in a way designed to sever the direct on-chain link between any specific deposit and any specific withdrawal. In the Binance case, Elliptic identifies only a relatively modest $5.8 million to $6.7 million in bitcoin, plus roughly $6.7 million in ether and solana, run through mixing services so far, a small fraction of the billions still unaccounted for, suggesting mixers alone are not where the bulk of the remaining funds currently sit.
Perhaps the most counterintuitive finding in Elliptic’s tracking is how little some assets have moved at all. Of $1.34 billion in traced ether, only $3 million has moved since the theft, and of $44 million in traced NEAR tokens, only $2.5 million has moved. This pattern suggests that, for certain assets, hackers may judge it safer to simply hold stolen funds untouched for an extended period, waiting for scrutiny to fade, rather than risk moving large sums through channels that forensic firms and exchanges are actively monitoring in real time.
The roughly 44% interdiction rate achieved so far on the Binance proceeds, well above the 3% recovery rate seen after the 2025 Bybit hack, suggests that improved cooperation between blockchain analytics firms, exchanges, and stablecoin issuers willing to freeze flagged funds is making large-scale laundering operations meaningfully harder to pull off cleanly than they were just a year earlier. The full, continuously updated tracking analysis is published on Elliptic’s own website.
Disclaimer: Cryip's content is strictly for educational and informational purposes and does not constitute financial, legal, or investment advice. Cryptocurrency involves significant risk, and readers assume full responsibility for their own financial decisions. Asset references are never endorsements.
To make complex crypto topics accessible to readers at all experience levels, our team uses AI tools strictly to refine language, correct grammar, and simplify terminology. AI is never used to draft facts, source information, or form conclusions. Every article is fact-checked and approved by a human editor before publication. Read our full AI Use & Content Policy.
