The stolen assets did not all disappear in a short period. On the contrary, the attackers are taking different actions on funds across different chains: some stablecoins were exchanged before being frozen, some assets were transferred to new addresses, and about $3 billion remains in wallets controlled by the attackers.

On the evening of October 29, Binance's 17 hot wallets transferred approximately $6.3 billion in assets to the attacker's address in less than 4 hours, involving 9 blockchains.

As of the on-chain tracking data on November 2, relevant institutions have frozen about $2.7 billion in assets, while the attackers still control about $3 billion. The remaining funds are mainly concentrated in BTC and ETH addresses and have not yet entered a clearly centralized liquidation phase.

This incident has currently transitioned from the initial asset transfer to the stages of fund exchanges, address adjustments, and ongoing tracking.

About $2.7 billion frozen, $729 million in stablecoins successfully transferred out

After the attack occurred, institutions such as Tether, Circle, and the Arbitrum Security Council, along with other issuers, gradually took freezing measures.

Bitquery tracking data shows that as of November 2, relevant institutions have cumulatively frozen about $2.7 billion in assets. Among them, some funds were already transferred before being frozen.

Approximately $729 million in stolen stablecoins successfully evaded freezing, with the attackers subsequently exchanging most of it for ETH and TRX, and about $60 million entering Aave.

This indicates that the hackers did not simply preserve all stolen assets unchanged but have begun altering the asset structure through exchanges.

However, freezing and recovering are two different concepts. An asset being locked by the issuer or relevant institutions does not mean that it has been returned; subsequent investigation and disposal procedures are still required.

BTC and ETH: Large amounts of funds still remain in the attackers' wallets

Currently, the most noteworthy are BTC and ETH.

On-chain data shows that the attackers currently hold approximately 539,862 ETH, which is about 2.7 times the initial amount of ETH they acquired. The increase mainly comes from using the stolen stablecoins, tokens, and TRX to purchase ETH.

Meanwhile, about 18,270 BTC are distributed across 19 addresses, with most addresses showing no subsequent transfers.

Among them, 8 large ETH addresses hold almost all related ETH but have not initiated any transactions; BTC is mainly distributed across 19 addresses, with some holding about 1,000 BTC.

This indicates that the attackers still retain a large number of high-value assets and have not disassembled or transferred everything to trading platforms.

As of the tracking statistics, investigators have not discovered clear records of these main funds entering exchange recharge addresses or mixers.

XRP, TRON, and Solana: Some funds have begun to move further

In contrast to the relatively static situation of BTC and ETH, funds on other networks have shown more distinct operations.

XRP: On November 2, approximately 233 million XRP first appeared to be transferred further, being sent to 7 new accounts. Prior to the transfer, the receiving accounts conducted small test transactions. As of the statistics collected, these new accounts have not continued to initiate transfers.

TRON: The relevant wallets that attackers previously used on the TRON network have mostly been cleared, with the last tracked fund transfer occurring in the early hours of November 1.

Solana: Some funds have been transferred to new wallets. One address holds approximately 485,277 SOL and has not continued to move; another address has continued to transfer funds since November 1, with a total of about 554,633 SOL transferred out.

These changes indicate that the pace of fund disposal across different chains is not consistent. Some assets remain at their original addresses waiting, some have entered new addresses, and others have changed their holding forms via exchanges and cross-chain operations.

At what stage are the hackers currently in?

Based on the on-chain records as of November 2, the subsequent disposal of this $6.3 billion asset can be divided into three stages:

• Completed: Large-scale transfers out of Binance’s hot wallets, some stablecoins were exchanged before freezing, and some TRON assets have been moved out of the original wallets.
• Ongoing: XRP has been transferred to new accounts, some Solana funds continue to move, and the attackers hold more ETH through exchanges.
• Not yet completed: About $3 billion is still controlled by the attackers, primarily BTC and ETH, and no clear large-scale exchange recharge or mixing records have been found.

The next most important observation will be whether the 19 BTC addresses begin transferring, whether the main ETH wallets see any transfers for the first time, and whether the 7 new receiving XRP accounts will continue to split funds.

After the $6.3 billion theft, the attackers did not immediately dispose of all funds. Currently, about $2.7 billion has been frozen, and about $3 billion remains under their control. What will truly determine the future direction of this incident are the large valuable assets that have yet to move, which addresses they will enter next, and how they will be processed.

If you are also following the Crypto market and want to participate in trading or asset allocation, you can register through the following exclusive channels to enjoy discounts:

Binance: Register through the exclusive link and fill in the invitation code aicoin668 to enjoy a 10% rebate.

Registration link: https://jump.do/zh-Hans/xlink-proxy?id=3

Benefit group: https://www.aicoin.com/link/chat?cid=gmLgwvKD1

OKX: Register through the AiCoin exclusive link to enjoy a permanent 20% rebate.

Registration link: https://jump.do/zh-Hans/xlink-proxy?id=2

Benefit group: https://aicoin.com/link/chat?cid=l61eM4owQ

Bitget: Register through the AiCoin exclusive channel to enjoy a 10% trading fee rebate.

Registration link: https://jump.do/zh-Hans/xlink-proxy?id=6

Benefit group: https://aicoin.com/link/chat?cid=N63yYYKQE

You are also welcome to join AiCoin-related communities to get more information on new coins and making money in exchanges:

Official Telegram group: https://t.me/aicoin_support

AiCoin Chinese Twitter: https://x.com/AiCoinzh

The content of this article only represents the author's personal opinion and does not represent the platform’s stance. The views, conclusions, and suggestions in the text are for investors' reference only and do not constitute any investment advice related to this platform. The market carries risks, and investments should be approached with caution.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。