Key Highlights:
- An address linked to the Binance hacker deposited 8,567 SOL (valued at approximately $798,000) into Privacy Cash, with related addresses displaying similar laundering behavior.
- Blockchain analytics firm Elliptic confirmed that roughly 87,000 SOL—worth an estimated $8 million—drained from the primary exploit wallet by November 3, routing through lending vaults, liquid-staking platforms, and new wallets.
- Investigators also traced approximately 28 BTC connected to the theft moving through 18 separate CoinJoin privacy transactions between November 1 and November 2.
Binance Exploiter Launders Stolen Funds via Privacy Cash and CoinJoin
Onchain tracking services have detected substantial movement of illicit funds tied to the historic Binance exploit, revealing an intricate laundering pipeline spanning multiple networks and privacy tools. Onchain Lens reported on November 3 that an address directly associated with the Binance hacker deposited 8,567 SOL into the anonymity-focused protocol Privacy Cash. The monitoring platform valued the transactions at roughly $798,000 and noted that several other addresses exhibited identical onchain behavior.
The transfers mark an escalation in the perpetrator’s efforts to obscure transaction trails. According to blockchain analytics company Elliptic, approximately 87,000 SOL had departed the primary Binance theft wallet by 08:40 UTC on November 3. The firm calculated the market value of those departed Solana tokens at approximately $8 million, pointing to rapid movement aimed at liquidating or swapping the stolen reserves.
Complex Multi-Hop Routing and Cross-Chain Conversions
Elliptic’s forensic breakdown revealed that the assets did not move directly to off-ramps. Instead, the attacker routed the 87,000 SOL through a layered series of newly generated intermediate wallets, decentralized lending vaults, and a liquid-staking service. These multi-hop maneuvers preceded token sales and cross-chain conversions into Bitcoin (BTC), designed to sever direct deterministic links to the original Binance exploit address.
Parallel to the Solana-based maneuvers, the threat actor targeted privacy-preserving protocols on the Bitcoin network. Elliptic documented that roughly 28 BTC originating from the Binance breach were funneled through 18 separate CoinJoin transactions. These mixing operations took place between November 1 and early November 2, confirming a coordinated, multi-asset effort to evade law enforcement and onchain tracking.
Why This Matters
The aggressive movement of stolen capital underscores the evolving sophistication of digital asset laundering techniques. Rather than relying solely on traditional mixers, modern exploiters routinely weave cross-chain swaps, decentralized finance (DeFi) primitives—such as lending vaults and liquid-staking services—and privacy applications like Privacy Cash and CoinJoin into their off-ramping strategies. The continued tracking of these funds by Elliptic and Onchain Lens highlights both the persistent visibility of public blockchains and the ongoing friction between compliance monitors and decentralized obfuscation tools.
Frequently Asked Questions
How much cryptocurrency did the Binance hacker move?
Forensic monitors identified two major fund movements: an 8,567 SOL deposit (worth about $798,000) sent to Privacy Cash, as part of a larger outflow of roughly 87,000 SOL ($8 million) tracked by Elliptic. In addition, around 28 BTC was routed through Bitcoin privacy mixers.
What methods did the hacker use to conceal the funds?
The perpetrator utilized a mix of intermediate wallets, DeFi lending vaults, liquid-staking protocols, the Privacy Cash service on Solana, and 18 CoinJoin transactions on the Bitcoin network before selling the tokens or converting them to other assets.
Who detected and reported the suspicious transactions?
The activity was monitored and reported by onchain tracking entities, specifically blockchain monitoring account Onchain Lens on November 3 and blockchain analytics firm Elliptic.
