Cryptocurrency stolen in the $6.34 billion Binance hack may already be passing through Chinese money-laundering networks, according to blockchain intelligence firm Elliptic, as investigators continue tracking one of the largest digital asset thefts on record.
In an analysis updated November 5, 2026, Elliptic said the attackers moved funds through approximately 12,000 wallets across 11 blockchains during the first three and a half days following the October 29 breach.
The operation involved more than 40,000 transactions, averaging roughly one newly used wallet every 25 seconds. Elliptic suggested that assets undergoing laundering may have been transferred to Chinese criminal networks previously used by North Korean cybercriminals.
However, the company has not established that specific Chinese laundering groups currently control the stolen funds. The FBI has attributed the attack to TraderTraitor, a North Korean state-linked hacking group, although Pyongyang has denied involvement.
Investigators Trace Complex Transfers Across Multiple Blockchains
Elliptic’s investigation found that approximately $3.35 billion remained in addresses associated with the Binance theft as of its latest update. Most of those holdings consisted of Bitcoin and Ethereum, which cannot be frozen directly by centralized token issuers.
The company estimated that only a negligible amount of the stolen cryptocurrency had been converted into cash. The laundering activity involved decentralized exchanges, cross-chain bridges and automated transaction sequences designed to complicate blockchain tracing.
Investigators observed repeated transfers, unsuccessful swaps and the movement of assets through multiple intermediary wallets. Elliptic said the patterns indicated extensive automation but did not demonstrate that autonomous artificial intelligence agents were directing the transactions.
Separately, blockchain analytics firm TRM Labs identified techniques involving newly created tokens, decentralized liquidity pools and lending receipt tokens. These methods can obscure the relationship between wallets receiving stolen assets and addresses subsequently exchanging them.
TRM also observed transactions passing directly between cross-chain bridges, reducing the visibility of intermediate wallet movements. Despite the complexity, blockchain investigators have continued identifying addresses linked to the theft and sharing intelligence with cryptocurrency service providers.
Binance reported on November 3 that approximately $2.85 billion in affected assets had been frozen or intercepted. The exchange also said it had replenished 98% of the impacted token assets using its own resources.
Chinese Laundering Networks Emerge as Potential Intermediaries
The possibility of Chinese criminal involvement reflects previously documented laundering arrangements associated with North Korean cybercrime operations. Michael Barnhart, a nation-state threat researcher at DTEX, told Recorded Future News that TraderTraitor has historically transferred stolen cryptocurrency to Chinese laundering networks in exchange for an agreed payment or percentage.
Such arrangements could allow the original attackers to transfer responsibility for moving and converting stolen assets to outside intermediaries. However, historical operating patterns do not independently establish who controls the funds involved in the current Binance investigation.
Elliptic distinguished between assets that remain largely stationary and funds actively circulating through laundering routes. It assessed that unmoved holdings were likely still controlled by North Korean actors, while assets undergoing laundering could already be managed by outside networks.
The distinction complicates attribution because blockchain transactions reveal asset movements but do not necessarily identify the individuals directing them. The FBI has urged cryptocurrency exchanges and other service providers to block transactions involving identified addresses connected to the theft.
Binance continues working with law enforcement, stablecoin issuers and blockchain analytics companies to restrict the movement of stolen funds. The exchange has pledged to absorb the financial impact rather than pass the losses to customers.
The investigation highlights the challenges of recovering cryptocurrency once stolen assets are dispersed across decentralized financial infrastructure. For investigators, identifying the ultimate beneficiaries and any intermediaries remains essential to determining how much of the outstanding funds can be recovered.
The involvement of Chinese laundering networks remains a credible investigative possibility, not a confirmed finding.