Blockchain analytics firm Elliptic reported that the actor behind the October 29, 2026 Binance hot-wallet breach has begun mixing a small portion of Bitcoin, with approximately 28 BTC (valued at about $2.2 million) processed through coinjoins using the WabiSabi protocol as of early November 2. At the same time, roughly $3.24 billion in assets linked to the theft remains in tracked addresses, primarily consisting of ETH and the original 18,270 BTC that have not yet been moved from their initial post-theft wallets.
The mixing involved Bitcoin obtained via conversion of some TRON-related funds and parked ETH, routed through 18 coinjoin transactions with high input counts. The bulk of the unfrozen stolen assets—estimated in the $3.0–$3.3 billion range after earlier freezes of stablecoins—continues to be monitored across multiple chains, with limited cash-out activity observed so far. Binance has covered the majority of user losses from its own reserves while the investigation and recovery efforts continue.
The Drivers of the Current Situation
The main development is the first confirmed mixing of a modest amount of Bitcoin from the Binance hack proceeds alongside the continued tracking of the large remaining balance. Confirmed elements include Elliptic’s identification of approximately 28 BTC ($2.2 million) entering coinjoins, the $3.24 billion still held in linked addresses (mostly ETH and the untouched original BTC), the use of WabiSabi/Wasabi-style mixing, the conversion path from other tokens into Bitcoin for laundering attempts, and the broader context of the $6.3 billion incident with substantial stablecoin freezes already achieved. These on-chain movements mark an early laundering step while the majority of high-value holdings stay stationary and observable.
Further mixing activity, address consolidations, or successful recovery actions will define the next phase of fund tracing.
Impact and Broader Context
The limited mixing attempt highlights both the challenges of laundering large non-freezable assets such as Bitcoin and the effectiveness of ongoing blockchain surveillance. It raises questions about the pace and scale of future laundering efforts, the resilience of coinjoin techniques against advanced analytics, the prospects for recovering the stationary BTC and ETH holdings, the role of industry and law-enforcement coordination in monitoring cross-chain flows, and the longer-term implications for exchange security narratives. Coverage distinguishes between the small volume already mixed and the much larger tracked balance that has seen little movement, underscoring that cash-out success remains limited to date.
Additional analytics updates, movement of the core BTC holdings, or official recovery announcements will clarify the trajectory of the remaining funds.
This analysis draws from Elliptic’s on-chain reporting, related blockchain investigations, and contemporaneous updates on the Binance incident. Exact remaining balances, further mixing volumes, and ultimate recovery outcomes remain subject to ongoing tracking and market conditions.