Binance Hack Funds Spread Across 12,000 Wallets

November 3, 2026 MM Crypto Team

In less than four days, the trail left by one of the largest crypto thefts on record split into thousands of separate paths. According to Bitcoin.com News on November 2, citing analysis by Elliptic, funds stolen from Binance on October 29 had spread across roughly 12,000 wallets on 11 blockchains, through more than 40,000 transactions. That pace works out at roughly one new wallet every 25 seconds, a figure that conveys the sheer speed of the operation better than any abstract description of laundering. It was not a slow, quiet dispersal over weeks or months. It was a rapid, industrial-scale effort to break a very large sum into many smaller, harder-to-follow pieces before investigators, exchanges and asset issuers could catch up.

The scale of the original theft explains why the dispersal had to be so large. The October 29 theft was reported at 6.43 billion dollars, a sum so large that it could not plausibly be hidden in a handful of wallets without drawing immediate attention. Every wallet that holds a large, flagged balance becomes a target for monitoring, and every transfer from such a wallet risks triggering a freeze if it touches a regulated service. Spreading the funds across 12,000 wallets changes that calculation. It creates a vast number of leads for investigators to follow, it dilutes the balance in any single address, and it gives the holder many more options for the next step, whether that is a swap, a bridge, a conversion or simply waiting. The challenge for the rest of the industry is that the same openness that makes this activity visible also makes it difficult to stop in real time.

What Elliptic hack tracking actually found

Elliptic’s analysis, as reported, provides a snapshot of a moving target rather than a final balance sheet. The headline figures are the wallet count, the blockchain count and the transaction count: about 12,000 wallets, 11 blockchains and more than 40,000 transactions in under four days. Those three numbers together describe a strategy of fragmentation. Using many blockchains, rather than one, prevents investigators from relying on a single chain’s tools or a single set of validators. Using many wallets prevents any one address from becoming the obvious choke point. Using tens of thousands of transactions creates noise, because each transfer must be examined to decide whether it is part of the theft, a legitimate trade by an unrelated user, or a deliberate decoy designed to waste investigators’ time.

One new wallet every 25 seconds, without AI agents

The pace of wallet creation has prompted speculation about automation, and in particular about whether artificial intelligence agents were involved. The reporting is clear on this point: the pattern was described as conventional automation, not evidence of AI agents. That distinction matters, because it prevents a dramatic but unsupported claim from distracting from the real story. Creating a new wallet on most blockchains is cheap and fast, and a simple script can generate thousands of addresses, fund them in sequence, and move value between them without any advanced intelligence. The skill in this kind of operation is not in inventing a new technology. It is in organising a large number of simple steps quickly, consistently and across multiple networks, while avoiding the mistakes that would link the whole chain back to a single point of failure.

How much was frozen, and how much remained

As of November 2, the reported split between frozen and remaining funds gives a clearer picture of that race. About 3.24 billion dollars remained in theft-linked addresses, while 2.85 billion dollars had been frozen. Those two figures do not add up to the original 6.43 billion dollars, and the gap is itself informative. Some funds will have been swapped, converted or lost to fees and slippage along the way. Some will have moved into addresses that had not yet been identified or classified by November 2. Some may have been spent, mixed or otherwise transformed in ways that make a simple remaining-versus-frozen comparison incomplete. Readers should therefore treat the two headline numbers as a snapshot of what was known and acted on at that date, not as a closed account that explains every dollar.

The Bitget link and the THORChain pause

Two smaller details in the reporting deserve attention because they show how one theft can intersect with others. First, about 16 million dollars was reported to have flowed into addresses containing proceeds from the Bitget exploit. That does not necessarily mean the same people were behind both incidents, and readers should not jump to that conclusion. Addresses can contain funds from multiple sources, especially when they belong to a service, a mixer or an intermediary that handles many users. But the overlap is a reminder that stolen funds do not move in isolation. They pass through shared infrastructure, they can be combined with other illicit flows, and investigators must untangle those connections before they can attribute any particular movement to a particular actor with confidence.

Attribution to North Korea’s TraderTraitor

On October 31, the FBI attributed the theft to North Korea’s TraderTraitor group. That attribution, reported alongside Elliptic’s figures, places the wallet-splitting operation in a specific context. TraderTraitor is a name used by investigators for a North Korean-linked actor associated with social-engineering attacks on crypto firms, often involving fake job offers, malicious software and long-term infiltration. If the attribution is correct, the dispersal across 12,000 wallets was not the work of an opportunistic thief who stumbled on a vulnerability. It was part of a planned operation by an actor with experience, resources and a track record of moving large sums through crypto infrastructure. That context also explains why the response involved multiple firms, exchanges and law-enforcement agencies, rather than a single company acting alone.

Binance’s account: extra entry points and bypassed controls

Binance co-chief executive Richard Teng was reported to have said that the theft involved additional entry points and bypassed approval controls. That brief description points to a serious internal failure, even though the full technical details have not been made public in the reporting summarised here. Approval controls are supposed to act as a safeguard: large or unusual movements should require multiple authorisations, checks or delays before they can be executed. If those controls were bypassed, it suggests that the attacker either found a way around the safeguard itself, or gained access to credentials or systems that allowed the safeguard to be circumvented. Additional entry points suggest that the compromise was not confined to a single weakness, but involved more than one route into the systems that held or managed the funds.

Changing crypto does not itself equal cashing out

One of the most important points for readers to hold on to is also one of the easiest to misunderstand. Changing crypto does not itself equal cashing out. Moving funds from one wallet to another, swapping Bitcoin for Ethereum, bridging to a different blockchain, or converting one token for another does not turn crypto into cash in a bank account. It changes the form and the location of the value, but the value remains in crypto, on public blockchains, where it can still be traced, flagged and, in some cases, frozen if it touches a compliant service. Cashing out, in the stricter sense, means converting crypto into fiat currency or into goods and services through an off-ramp that may itself be regulated, monitored or blocked. That final step is often the hardest for a thief, because it is where the crypto world meets the traditional financial system and its identity checks.

That distinction explains why the wallet count, on its own, does not tell us how much money the attacker has actually realised. A holder with 12,000 wallets still faces the problem of exiting those positions without triggering a freeze, a seizure or an arrest. It also explains why investigators focus so much effort on exchanges, stablecoin issuers and other off-ramps: those are the points where a thief must interact with a service that can refuse, report or freeze. For ordinary users, the lesson is reassuring in one sense and sobering in another. The public nature of blockchains means that large-scale movement is visible, even when it is fragmented. But visibility is not the same as recovery, and the gap between seeing stolen funds move and getting them back remains one of the hardest problems in crypto security.

Frequently asked questions

What does it mean that funds spread across 12,000 wallets?

It means theft-linked value was divided among about 12,000 addresses on 11 blockchains, through more than 40,000 transactions, in under four days. Fragmentation makes tracking harder, because each wallet must be identified and followed separately, but it does not make the funds invisible, since blockchain transactions remain public.

Was artificial intelligence used to create the wallets?

The reporting described the pattern as conventional automation, not evidence of AI agents. Simple scripts can generate thousands of wallets and move funds between them quickly, without advanced intelligence, so the speed alone does not prove that AI was involved.

How much was frozen and how much remained on November 2?

About 2.85 billion dollars had been frozen, while about 3.24 billion dollars remained in theft-linked addresses as of November 2. The two figures do not sum to the original 6.43 billion dollars, because some funds were swapped, lost to fees, or not yet classified at that date.

Does swapping crypto mean the thief has cashed out?

No. Changing crypto does not itself equal cashing out. Swaps, bridges and wallet transfers keep value in crypto on public blockchains. Cashing out means converting crypto into fiat or goods through an off-ramp, which is often the hardest step and the point where freezes are most likely.

Who was blamed for the Binance theft?

The FBI attributed the theft to North Korea’s TraderTraitor group on October 31. That is an official assessment based on technical and tactical indicators, not a court finding, and further evidence may emerge over time.

Source: Bitcoin.com News

MM Crypto Analysis Web