Binance theft, week one: 71 BTC through THORChain, and one address shared with the Bitget case
What our own tracking of the Binance theft shows after a week: the Bitcoin leg went into THORChain as soon as it reopened, one step went through a CoinJoin, nothing we follow reached Monero — and one consolidation address received steps from both our Binance and our Bitget cases.
A week ago we wrote about the Binance theft from the custody side. This is the follow-up from the tracking side: where the money we can follow went, and one detail we have not seen written up elsewhere.
Where Binance stands
Binance published its post-mortem on 3 November: attackers posed as recruiters, planted malware on an engineer’s work computer and used a compromised internal AI tool to reach the service that signs withdrawals. By 4 November it had replenished about 98% of the stolen tokens from company funds, and about $2.85 billion had been frozen or intercepted — mostly USDT and USDC frozen by Tether and Circle. Withdrawals for six remaining assets are due to reopen by 13 November.
What our tracking shows
We follow the Bitcoin leg of the theft step by step on the public chain. It started moving on 1 November.
- THORChain. The protocol halted trading on most of its chains on 31 October after an Ethereum reorganisation and resumed late on 3 November. From 5 November, 28 of the steps we follow went straight into it: 18 steps and about 47.3 BTC on 5 November, 10 steps and about 23.9 BTC on 6 November.
- CoinJoin. One step, 1.07 BTC, went through an equal-output CoinJoin.
- No Monero. None of the steps we follow went to a route that ends in XMR.
These are the steps our tracker follows, not the whole flow. Elliptic counts more: about 1,650 BTC converted from other stolen assets by 6 November, and The Crypto Times reports about $242 million moved through Tron in two days via Relay, THORChain, Chainflip and Symbiosis.
The address shared with the Bitget case
We have also been tracking the September Bitget theft. On 6 November one consolidation address — bc1q82cksuj36wfc2khdpmhlk0szxv7u8fe894t4zw — received a step from our Binance case (1.712 BTC) and, the same day, a step from our Bitget case (1.2406 BTC). On the public chain the address has about 95 transactions and has received about 56.6 BTC, gathering deposits and passing them on in larger amounts.
One shared address does not prove one operator. It fits what Elliptic reports independently: part of the Binance money went to wallets that hold proceeds of the Bitget exploit, which is also attributed to the TraderTraitor group.
What it means if you use these protocols
Nothing here put ordinary users’ funds at risk. But three protocols in our catalog carried stolen money this week, and they handle it very differently:
- Relay screens addresses when a quote is requested and again before a fill, and refuses flagged addresses.
- Chainflip brokers can reject deposits they flag as high-risk and send them back to the refund address.
- THORChain has no address screening in the protocol itself; its terms only exclude sanctioned persons. Some interfaces built on it screen addresses on their side.
If you swap through these routes, your coins may share pools with stolen funds. That is a property of permissionless liquidity, not a sign of wrongdoing by the users.
Sources: Binance post-mortem (3 Nov) as reported by TRM Labs and The Coin Republic; Elliptic via The Crypto Times (7 Nov); THORChain status; our own flow cases for the Binance and Bitget thefts.