Binance hacker group shifts over $1B in ETH to fresh wallets
Security & Exploits ·
On-chain trackers say the group behind a reported $5.8B Binance exploit has begun moving large ETH balances, a step typically preceding mixer-based laundering.
The group linked to the reported $5.8B Binance exploit has moved more than $1B worth of ETH into a set of new wallets, according to activity flagged on X. The transfer involves six distinct addresses that received funds in the latest round of movements, with one wallet appearing twice in the published list, suggesting repeated or staged transfers rather than a single transaction.
The scale of the transfer, over $1B in ETH, is being read as preparation for laundering rather than an endpoint. Observers tracking the funds say the likely next step is routing through Tornado Cash and other mixing services, a common method for obscuring the trail of stolen crypto before it reaches exchanges or over-the-counter desks. One of the implicated addresses can be viewed directly on etherscan.io, where the balance and transaction history remain publicly visible.
The movement follows a separate on-chain message attributed to the suspected attacker, in which the sender discussed plans to launder the proceeds through mixers and decentralized exchange swaps. That message, part of the same cluster of reports, aligns with the current wallet activity and suggests the laundering process may already be underway rather than merely anticipated.
Two distinct sources are now covering the cluster, pointing to the same underlying pattern: large ETH balances tied to the $5.8B exploit being consolidated and redistributed across new addresses ahead of further movement.
What remains unconfirmed is whether any of the $1B in ETH has yet reached a mixer or exchange, and whether Binance or other platforms have frozen or flagged any of the destination wallets. The original $5.8B exploit figure itself has not been independently verified beyond the reports feeding this cluster, and the identity of the hacker group remains unknown. Continued on-chain tracking of the listed addresses will likely determine whether laundering attempts succeed or are intercepted.