Blockchain investigators identify renewed activity through THORChain and Chainflip as North Korean-linked attackers continue moving assets from the largest cryptocurrency theft on record. Approximately $891.37 million in cryptocurrency stolen during the October 29, 2026, Binance hack may have been transferred or laundered, according to blockchain monitoring platform Onchain Lens, as investigators track renewed movement across decentralized trading infrastructure. In an update published November 10, Onchain Lens estimated that attackers retained control of approximately $2.85 billion in additional assets, while another $2.6 billion remained frozen.
The figures relate to the $6.34 billion security breach that affected Binance wallets across multiple blockchains, making it the largest cryptocurrency theft recorded to date. Over the preceding two to three days, wallets associated with the attack had been actively transferring funds through cross-chain liquidity protocols THORChain and Chainflip. However, the $891.37 million estimate includes assets potentially transferred or laundered. It does not establish that the attackers successfully converted that amount into cash or transferred it beyond their control.
Hackers Continue Moving Stolen Assets Through Cross-Chain Protocols
The latest activity highlights how cryptocurrency attackers use decentralized infrastructure to move stolen assets between blockchain networks while attempting to complicate forensic investigations. THORChain and Chainflip facilitate cross-chain asset exchanges, allowing users to convert cryptocurrency without relying entirely on centralized trading platforms. Such transactions can make it harder to follow funds when assets move between networks, although their records remain accessible to blockchain investigators. Independent research published by blockchain analytics firm Bitquery identified approximately $333 million in assets moved through laundering routes during the first week following the Binance breach.
That analysis covered transactions through November 6, including approximately $113 million routed through THORChain. Another investigation by Global Ledger traced $1.28 billion in transfers from attacker-controlled wallets to external counterparties between October 29 and November 4. However, Global Ledger’s broader figure included swaps, bridges, lending transactions and other transfers, meaning it cannot be directly compared with estimates of successfully laundered funds. The differing totals reflect separate methodologies, reporting periods and definitions of asset movement.
FBI Attributes Binance Attack to North Korean Hacking Group
The Federal Bureau of Investigation attributed the October 29 attack to North Korea’s TraderTraitor cybercrime group in an October 31 advisory. The agency warned cryptocurrency exchanges, blockchain infrastructure providers and decentralized services to identify and block transactions connected to attacker-controlled addresses. Binance subsequently confirmed that approximately $6.34 billion in cryptocurrency had been affected, announcing measures to replenish customer assets using company resources. In its November 3 update, Binance reported that approximately $2.85 billion had been frozen or intercepted, exceeding Onchain Lens’s later $2.6 billion frozen-assets estimate.
The difference has not been fully reconciled and may reflect variations in classification, valuation or reporting dates. Meanwhile, blockchain analytics firm Elliptic identified more than 20,000 wallets and 65,000 transactions associated with the laundering operation across 16 blockchains. Elliptic also documented attempts to disguise stolen funds through newly created memecoins and decentralized liquidity pools. Despite the extensive transaction activity, the firm estimated that only a negligible portion of the stolen cryptocurrency had been successfully cashed out. The latest $891 million assessment therefore illustrates the continuing movement of stolen assets rather than confirmed realization of illicit proceeds, as investigators and exchanges attempt to trace and restrict the remaining funds.
