Binance Hacker Shifts $3B of Stolen Funds via Chinese Networks
Security & Exploits ·
Chainalysis has frozen roughly half of the $6.3 billion taken in a Binance exploit while investigators trace the rest moving through money laundering channels tied to China.
Bloomberg reporting cited by trackers states that the Binance hacker has routed stolen funds through Chinese money laundering networks, with Chainalysis estimating that about $3 billion of the $6.3 billion total has been frozen to date. That leaves a substantial portion of the stolen assets still in motion or otherwise unaccounted for as tracing efforts continue.
The laundering activity points to an effort to obscure the origin of the funds before they can be converted or withdrawn, a step that typically determines how much of a stolen sum is ultimately recoverable. Freezing roughly half of the total suggests exchanges and analytics firms have had some success intercepting funds, but it also underscores how much remains outside investigators' control.
Separately, SEAL Org has profiled TraderTraitor, a North Korean hacking group linked to recent exploits targeting Binance, Bitget, AFX, and LayerZero. Reporting on the group's activity indicates it spent 8 weeks inside Binance before executing a theft described in that account as $6.4 billion, a detail that raises questions about whether the intrusion could have been detected sooner.
In a related but separate development, Binance disabled API keys associated with SignalPlus after a security warning, with Binance confirming that user funds remain safe. Binance and Deribit also revoked API keys tied to SignalPlus following the reported issue, and users were advised to revoke their own API keys across all exchanges as a precaution.
What remains unclear is the exact mechanism by which the Chinese laundering networks are converting or moving the unfrozen portion of the funds, and whether the $6.3 billion and $6.4 billion figures cited across reports refer to the same incident or reflect differing estimates. It is also not yet established whether the SignalPlus API issue is connected to the broader exploit or a separate security matter. Six distinct sources are currently covering elements of this cluster, and further confirmation from exchanges or blockchain analytics firms is expected as tracing continues.