The hackers behind Binance’s record theft are still moving billions through decentralized crypto services that continue to process the funds and collect fees, underscoring how hard it remains for law enforcement to choke off illicit flows even after public warnings from the FBI.
Binance Hackers Move Funds Through THORChain
The laundering campaign matters because it shows the economic weak point in crypto’s infrastructure: services that claim to be decentralized can still generate revenue from transactions tied to North Korea-linked cybercrime while operating outside the screening and reporting rules that bind banks and many regulated exchanges. That leaves investigators with a race against time as stolen assets are split across thousands of wallets, swapped across blockchains and routed through mixing tools designed to obscure their origin.
Sentiment Indicators
Chainalysis said the hackers splintered the proceeds into more than 10,000 wallets. In the first 72 hours after the heist, THORChain processed more than $46 million of stolen Binance funds and collected more than $200,000 in fees, while nearly $4 million was mixed through Wasabi Wallet, according to the firm. THORChain also handled nearly $1 billion in transactions after North Korea’s $1.5 billion Bybit hack last year, generating at least $12 million in fees, Chainalysis said.
The numbers highlight a broader tension in crypto markets and policy. Stablecoin issuers such as Tether and Circle were able to freeze roughly half the stolen funds by blacklisting wallets, but close to $3 billion remains under hacker control, according to tracing firms. For investors, that raises the odds of harsher oversight on decentralized finance, more scrutiny of node operators and coordinators, and a fresh compliance burden for legitimate crypto businesses that rely on the same rails to move capital efficiently.
The story also lands in a market already trading on regulatory risk. Bitcoin is sitting below its 50-day moving average, with technical readings showing momentum weakening, while Coinbase and MicroStrategy have both slid sharply from recent levels. As authorities continue tracing the Binance haul and prosecuting infrastructure used to launder it, the next catalyst is likely to be whether regulators move from warnings to enforcement against the services that keep profiting from the flows.
| Entity | Gains | Losses |
|---|---|---|
| THORChain operators | ▲Fee revenue | ▼Regulatory scrutiny |
| Binance hackers | ▲Laundering capacity | ▼Asset freeze risk |
| Tether and Circle | ▲Compliance credibility | ▼Exposure to blacklisted flows |
| Coinbase, MSTR holders | ▲None | ▼Sector-wide enforcement overhang |
