The investigation into the massive Binance security breach has entered a new phase. Although blockchain investigators and crypto companies have managed to freeze approximately $2.85 billion in stolen assets, billions of dollars in cryptocurrency remain under the attacker's control.

According to blockchain analytics firm Elliptic, approximately $6.43 billion in crypto assets was taken from Binance in the October 29 incident. Its analysis indicates that around 44% of the stolen funds have been frozen or seized, while approximately $3.25 billion remains in assets that cannot be directly frozen by their issuers.

The laundering operation has also become increasingly complex. Funds have moved across multiple blockchain networks and thousands of wallet addresses. Reports have additionally indicated that the attacker has begun using CoinJoin, a transaction-mixing technique that can make it more difficult to identify the movement of individual funds.

The situation highlights an important challenge for the crypto industry: freezing a substantial portion of stolen assets does not necessarily mean the remaining funds have been recovered.

Binance Hack: How Much Cryptocurrency Was Stolen?

Elliptic's investigation puts the total value of the stolen cryptocurrency at approximately $6.43 billion.

The incident involved Binance hot wallets across 11 blockchain networks. The stolen assets included Bitcoin, Ethereum-based tokens, stablecoins and other cryptocurrencies.

Binance previously confirmed that unauthorized withdrawals had affected its hot-wallet infrastructure. In its October 30 security update, the exchange said it was working with law enforcement, blockchain intelligence firms and asset issuers to trace and freeze the affected funds.

The exchange also said it would cover the financial impact of the incident through its Secure Asset Fund for Users (SAFU) and corporate treasury, rather than passing the losses on to customers.

The scale of the incident has made tracking and recovering the stolen assets a major operation involving exchanges, stablecoin issuers, blockchain networks and analytics companies.

$2.85 Billion Frozen, But Around $3.25 Billion Remains

One of the most significant developments is the amount of cryptocurrency that investigators and industry participants have managed to freeze.

Elliptic has verified approximately $2.85 billion in frozen or seized funds. That represents roughly 44% of the $6.43 billion theft.

However, the remaining funds present a different challenge.

Elliptic's analysis indicates that the attacker controls approximately $3.25 billion in assets that cannot be directly frozen by a central issuer. These assets are spread across more than 800 wallet addresses and include substantial holdings of Bitcoin, Ethereum and XRP.

Metric	Estimated amount
Total cryptocurrency stolen	$6.43 billion
Funds frozen or seized	$2.85 billion
Share frozen or seized	Approximately 44%
Assets still controlled by attacker	Approximately $3.25 billion
Wallet addresses holding remaining assets	More than 800

Figures are based on Elliptic's published analysis and can change with cryptocurrency prices and further tracing.

The distinction between frozen funds and remaining assets is important. Cryptocurrency such as USDT and USDC can be frozen by their issuers when relevant addresses are identified. Bitcoin and certain other decentralized assets do not have a central issuer with the same ability to block transactions.

As a result, investigators may be able to trace these assets without having the technical ability to freeze them directly.

Why Is the Attacker Reportedly Using CoinJoin?

Another development drawing attention is the reported use of CoinJoin.

CoinJoin is a privacy technique in which multiple users combine their cryptocurrency transactions into a shared transaction. This makes it harder for outside observers to determine which output belongs to which participant.

It does not automatically make funds untraceable, nor does using CoinJoin by itself establish that a transaction is connected to criminal activity. The technique has legitimate privacy uses.

In the context of the Binance investigation, however, its reported use could complicate blockchain analysis.

Investigators generally follow the movement of cryptocurrency by examining transaction histories, wallet relationships and transfers between networks. Mixing techniques can make it more difficult to establish a clear connection between the original stolen funds and their later destinations.

That does not mean investigators lose all visibility. Blockchain analytics firms can continue examining transaction patterns, wallet activity and links to known addresses.

The reported CoinJoin activity therefore adds another layer to an already complicated tracing operation.

Tron and Cross-Chain Transfers Add to the Complexity

The movement of funds across blockchain networks has been another major part of the investigation.

Elliptic's analysis describes extensive activity involving Tron, including funds being distributed from a main wallet into numerous smaller addresses. The company reported that the transfer pattern continued around the clock, with repeated transaction sizes and short intervals between transfers.

Its separate investigation into the laundering operation described activity that appeared to be automated. Funds were distributed to new wallets, moved through different services and routed across blockchain bridges.

Elliptic also identified the use of decentralized exchanges and cross-chain services in the movement of assets.

These methods can make investigations more difficult because the same stolen funds may pass through several networks and services before reaching another wallet.

The company has also linked some Tron-related funds to proceeds associated with the earlier September 2026 Bitget exploit.

For investigators, this creates a wider challenge than simply identifying the first wallet that received the stolen cryptocurrency. They must follow the funds through multiple transactions and determine which addresses and services may have received exposure to the stolen assets.

Why Some Stolen Crypto Can Be Frozen While Other Assets Cannot

The difference between centralized stablecoins and decentralized cryptocurrencies is central to this investigation.

Stablecoins such as USDT and USDC are issued by companies that can blacklist specific addresses under their respective control mechanisms. When funds connected to a reported theft are identified, issuers may be able to prevent those tokens from being transferred.

Bitcoin does not operate in the same way. There is no central Bitcoin issuer that can blacklist a wallet and prevent it from sending BTC.

The same general limitation applies to native XRP and certain other decentralized assets.

This explains why a significant amount of cryptocurrency can remain under an attacker's control even after investigators have identified the wallets holding it.

Tracing and freezing are two different capabilities. Investigators may know where funds are located without having the authority or technical means to stop them from moving.

Binance Says It Will Cover the Losses

The incident has also raised questions about the financial impact on Binance users.

In its October 30 security update, Binance said it would absorb the losses associated with the stolen assets through SAFU and its corporate treasury.

The exchange reported that it had set aside more than $6.34 billion in company funds and was working to restore affected services while strengthening its security infrastructure.

Binance also said it was cooperating with law enforcement and industry partners to trace and freeze the affected assets.

These measures are separate from the blockchain recovery effort. Even if Binance covers the financial impact for users, investigators and industry participants still need to follow the stolen cryptocurrency and prevent it from entering legitimate markets.

What Happens Next?

The recovery effort is likely to remain complicated as the attacker continues to control a substantial amount of cryptocurrency.

Investigators will need to monitor newly created wallets, cross-chain transfers, decentralized exchanges and services that may receive funds linked to the incident.

Crypto exchanges and compliance teams may also face pressure to improve transaction monitoring. A wallet that appears unrelated to suspicious activity at one point could later receive funds connected to a known theft.

Elliptic has emphasized the importance of continuous monitoring because the laundering operation has involved repeated transfers and automated-looking activity.

The reported use of CoinJoin adds another challenge, but it does not guarantee that the stolen assets will escape detection. Investigators can continue to examine transaction patterns and identify potential connections as new information becomes available.

For the wider crypto industry, the case is another reminder that blockchain transparency does not automatically make stolen funds easy to recover. Public transaction records can help investigators follow assets, but the ability to freeze or seize them depends on the assets, services and jurisdictions involved.

Frequently Asked Questions

How much cryptocurrency was stolen in the Binance hack?

Elliptic estimates that approximately $6.43 billion in cryptocurrency was stolen from Binance in the October 29, 2026 incident.

How much of the stolen Binance crypto has been frozen?

Elliptic has verified approximately $2.85 billion in funds as frozen or seized, representing around 44% of the estimated theft.

How much stolen cryptocurrency remains with the attacker?

Elliptic's analysis indicates that the attacker still controls approximately $3.25 billion in assets spread across more than 800 wallet addresses. The figure can change as funds move and market prices fluctuate.

What is CoinJoin?

CoinJoin is a privacy technique that combines multiple cryptocurrency transactions into a shared transaction. It can make it more difficult to determine which outputs belong to individual participants.

Can Bitcoin stolen in a hack be frozen?

Bitcoin does not have a central issuer that can blacklist addresses and freeze BTC. Investigators can trace Bitcoin transactions, but stopping the movement of BTC generally requires intervention by services or authorities that can control access to the funds.

Will Binance users have to pay for the stolen funds?

Binance said it would cover the financial impact of the incident through its SAFU fund and corporate treasury. The exchange stated that users would not bear the losses.

---

Editorial Note

This report distinguishes between cryptocurrency that has been frozen or seized and assets that investigators have traced but that remain under the attacker's control. Figures are based on published reporting and Elliptic's analysis available at the time of writing. The reported CoinJoin activity should not be interpreted as proof that all remaining funds have passed through a mixing service.

CoinAINews Editorial Team