How are hackers laundering the $6.3 billion in cryptocurrency stolen from Binance?

Following the theft of $6.3 billion from Binance last week, the hacking group moved quickly to obscure the flow of funds. According to Chainalysis, the stolen assets were split across more than 10,000 wallets within minutes. Stablecoin issuers Tether and Circle froze roughly half of the assets within hours, but according to blockchain tracing firms, $3.3 billion remains under the hackers' control. The group has since broken the funds into smaller amounts and moved them back and forth across multiple blockchains and transaction mixing services, a process that complicates tracing.

Two services have been central to the laundering effort. According to Chainalysis, THORChain, a cross-chain conversion service, processed over $46 million in stolen funds in the 72 hours after the Binance hack and collected more than $200,000 in fees, which were distributed to those operating the system. Separately, nearly $4 million moved through Wasabi Wallet, a privacy tool that obscures the origin of Bitcoin transfers through a coordinating entity. Per data from a Wasabi activity tracker, one coordinator handles over 99% of transactions on the system. That coordinator, an American developer using the pseudonym Kruw, received only a negligible amount of money for the work, according to Chainalysis. Kruw has said that maintaining the privacy service reflects a belief in individual liberty and anarchist capitalism.

The platforms have a track record in major thefts. THORChain was previously used after the 2025 attack on Bybit, which lost $1.5 billion, with the hacking group conducting nearly $1 billion in transactions through the platform. Chainalysis estimates operators earned at least $12 million in fees from that activity. Last weekend the FBI urged services to block transactions tied to the Binance hack and named THORChain node operators, but THORChain kept operating and wallets continued to use Wasabi Wallet.

The developers argue they cannot or are not obligated to intervene. Chad Barraford, co-founder of THORChain, said in an online radio program in October that the system was not designed to block individual transactions or wallets. Traditional financial institutions must monitor and report suspicious transactions, but decentralized finance is not subject to comparable strict regulation. Scott Armstrong, a former federal prosecutor now in private practice, said providing tools to avoid tracing after thefts appears to have become part of the business for some crypto services. In the US, prosecutors have previously secured convictions against blockchain service operators for intentionally assisting money laundering. In 2025, investors in a THORChain-based lending platform sued Barraford and John-Paul Thorbjornsen, alleging both had access to a special administrator key that could alter platform operations, and that Thorbjornsen used it to try to prevent the lending system from collapsing. Barraford denied the allegations and did not respond to the Wall Street Journal's request for comment on THORChain's role in the Binance hack. Thorbjornsen said he is no longer directly involved with THORChain, that the governance key has been removed, and that the system now runs through 111 network nodes operated by unnamed individuals.