Binance Laundering Trace Shows Limits Of Stablecoin Freezes
SomaXBT's Tron tracing and Elliptic's analysis show why freezing stolen tokens leaves a separate task of following converted funds.
The laundering accounts published after Binance's 29th October 2026 theft describe two different outcomes: stablecoin issuers blocked part of the stolen money, while attackers converted other funds and moved them across networks. Freezing an issuer's token did not give that issuer control over every asset received in exchange.
Our earlier Binance report covers the theft and initial asset freezes.
In a thread published on 1st November, investigator SomaXBT estimated that about $242 million had been laundered through the Tron leg in roughly two days. The detailed posts describe returned bridge deposits, repeated attempts and destinations still unresolved, all of which matter when interpreting the headline amount.
Conversion Changed What Could Be Frozen
TRM Labs' initial tracing, covering activity through 00:30 UTC on 30th October, identified 612.7 million Tether (USDT) and 46.4 million Tron (TRX) stolen on Tron. USDT is designed to follow the US dollar; TRX is the network's native token. TRM recorded Tether freezing 378.7 million USDT on that network.
Elliptic's analysis updated at 08:00 UTC on 1st November describes another part of the sequence. It says 234 million USDT was exchanged for 638 million TRX, which passed through five addresses and then a distribution wallet. From there, funds travelled through exchanges, a lending protocol and at least six bridges, services that move value between blockchains. Almost all of that routed value was received as Ethereum (ETH), or Ether, the Ethereum network's native cryptocurrency.
A stablecoin issuer can block its own token but cannot apply the same power to Ether. Elliptic also distinguishes emergency intervention by a network's governance from an issuer freezing its token. The available freezing power depends on both the token and the network.
Our stablecoin explainer describes issuer controls alongside backing and redemption.
A Returned Deposit Is Not A New Pot Of Money
SomaXBT's Chainflip account reports 49.47 million USDT submitted across 571 deposits. It says 17.91 million USDT came back as refunds and was submitted again, sometimes repeatedly.
Subtracting those stated refunds from stated deposits leaves 31.56 million USDT. This is a subtraction of reported deposits and refunds. It does not establish what a final recipient received or what was recovered. It shows why adding every attempted deposit would count some money more than once.
Elliptic separately reported repeated timing, swap amounts and retries, interpreting the pattern as software driven. Its observations support the broader account of repeated routing, without independently establishing SomaXBT's $242 million total. Use of a service also does not establish that its operators knowingly assisted the attacker.
Screening Has To Follow The Next Address
The FBI's 31st October notice attributes the theft to North Korea's TraderTraitor activity and reports conversion primarily into ETH. The agency calls on service and infrastructure providers to reject payments involving those addresses, including funds that have moved onwards from them.
That reaches beyond freezing a token at its original destination. Elliptic's incident blocklist changes as investigators identify addresses, and the firm explicitly says absence from that list says nothing about an address's wider risk. The converted funds can remain traceable even when the stablecoin issuer can no longer freeze the asset being moved.
