Stolen Binance Assets: $3.24 Billion Remains as 28 BTC Enters CoinJoins

Read the balance and the movement separately

Elliptic's November 2 research reports about $3.24 billion in linked addresses and about $2.85 billion frozen or seized. Its balance chart labels current values at approximately 15:00 SGT on November 2. The page's update line gives 15:30 SGT. A separate activity graphic includes observations through 16:45 SGT. Those cutoffs serve different parts of the report and should stay attached to their respective figures.

The remaining-address number describes an attributed stock of assets. The CoinJoin number describes a movement involving a smaller quantity of bitcoin. Adding the two would mix a balance with a transaction amount. Subtracting one from the other would also need evidence that their scopes and valuation times match. Elliptic's article does not present that subtraction as an updated balance.

The same care applies to the frozen figure. Elliptic's text uses both “frozen or seized” and “frozen” when discussing the approximately $2.85 billion. We retain the broader description here. The report does not say that this amount has been distributed to customers. A restriction on the movement of assets and a completed repayment answer different questions.

Elliptic gives the original stolen amount as $6.43 billion. Its chart distinguishes values at the time of theft from current values on the right-hand side. That difference prevents a neat subtraction from becoming a reliable estimate of missing money. Changes in asset values and the categories used in the chart matter.

What 28 BTC across 18 CoinJoins tells us

Elliptic dates the first mixing activity to November 1. By 14:02 SGT on November 2, it says roughly 28 BTC, valued in the report at about $2.2 million, had passed through 18 CoinJoins. The firm associates those transactions with WabiSabi, the protocol used by Wasabi Wallet and similar wallets. The report's description concerns this observed incident; it does not imply that every user of those wallets is involved.

For readers following the investigation, the relevant change is the appearance of a transaction category that complicates visible links between incoming and outgoing bitcoin. Elliptic describes CoinJoins as transactions combining multiple users' coins. The news is the research firm's identification of this activity and its stated quantity.

A report that funds entered mixing transactions also leaves several questions unanswered. It does not establish the identity of every later recipient or a completed sale for cash. It does not show that every asset attributed to the incident has followed that route. The stated 28 BTC concerns a particular observation window, while the broader $3.24 billion figure includes mainly BTC and ETH held in linked addresses.

Elliptic says only a negligible amount has likely been cashed out. That remains the firm's assessment, with the uncertainty expressed in its wording. The firm distinguishes conversion between cryptoassets from cashing out. We cannot convert its judgment into a precise recovered amount or assume that an identifiable on-chain balance is immediately accessible to investigators.

Thousands of wallets describe workload, not thousands of attackers

The research describes roughly 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days. These figures explain why a short list of destination addresses cannot represent the entire investigation. They do not count individual people. A wallet count, a transaction count and the number of human operators measure different things.

Elliptic says activity on Tron involved about 7,700 addresses. It also reports that nine large addresses held 89% of the attacker's ETH and had not moved since October 30. The two observations can coexist: many small addresses may be involved while a large share of an asset remains concentrated elsewhere. Counting addresses alone cannot tell a reader how much value has moved.

The report describes movement across chains, changes of asset and transfers involving lending vaults. Here those categories explain the analyst's challenge in following funds across different records. They should not be read as proof that attribution disappears after each change. Elliptic continues to classify addresses as linked to the incident, while explicitly saying the blockchain does not show who currently controls them.

Our reading is that subsequent updates should identify which measure changed. More addresses would change the tracing workload. More value moving out of previously inactive addresses would change the distribution of assets. A newly supported claim of seizure or cash-out would change a different part of the account. Treating all three as the same kind of progress makes the numbers harder to interpret.

Automation does not establish AI involvement

Elliptic says the activity was clearly automated. It points to recurring timing, preset amounts, retries and changes of tactics introduced at intervals. Its Tron analysis describes about 32,000 transactions, with a peak near 1,300 in an hour. Those observations support its assessment that software was involved in handling the workload.

The firm also says it has seen nothing demonstrating an AI agent making decisions. That distinction matters because a large transaction count can invite a much stronger technological claim than the evidence supports. “Automated” describes activity carried out by software under some instructions. Elliptic's report does not establish how every instruction was chosen or who gave it.

Readers should preserve the scope of that conclusion. The source has not proved that AI could never have been involved anywhere in the incident. It has said the observed behavior supports conventional automation and provides no evidence of AI decision-making. A future finding would need evidence addressing that specific question, rather than another repetition of the wallet count.

PANews' November 2 item carries the same balance, wallet and mixing figures and attributes them to Elliptic. It also repeats the distinction between routine automation and evidence of AI involvement. PANews is a second publication carrying the research, rather than an independent reconstruction of those transactions.

What this means for you

For a reader waiting on a transfer, start with the individual transaction rather than a share of the headline total.

1. Open the pending transfer in your Binance account history. Keep the asset name and network beside the transaction reference, then record the displayed status and observation time. If it changes, retain the earlier record.
2. Use the support route already available inside your account to ask about that specific transfer. Provide its amount, network and reference instead of an incident address copied from a news report.

A transaction reference can help distinguish a transfer that has been broadcast from an account request still awaiting processing. Read the label your service actually provides; this article does not verify Binance's current processing state or any particular network's availability. Where the account record lacks a transaction reference, describe that absence accurately instead of inventing one from an unrelated address in an incident report.

If contacting support about a pending transfer, use the existing route inside the account and identify the transfer you mean. The incident-wide $3.24 billion figure does not replace the amount and reference on that record. A claim about compensation requires an attributable statement describing eligibility and the process; neither source opened for this update establishes a personal entitlement.

Treat messages offering “Binance compensation” or asking for a recovery payment as a separate claim requiring verification through the service's established channel. Do not let the presence of an accurate incident number persuade you to use an unfamiliar link or disclose wallet recovery material. Elliptic also warns of look-alike addresses and fake-token activity in the incident's transaction records. An address appearing near an attributed wallet is insufficient evidence of common control.

What remains unconfirmed

The sources reviewed here do not give a customer repayment schedule, a verified balance for any reader, or a complete cash-out total. They also do not independently establish the identity behind each address now holding funds. Elliptic explicitly distinguishes the wallets visible on-chain from whoever currently controls them. We retain that uncertainty rather than assign a human identity to every transfer.

There is also a timing question for anyone comparing updates. A publication time, a chart valuation cutoff and the last transaction observation can be different. The present report contains all three. When a later figure appears, compare the relevant cutoff and asset category before deciding that funds have been newly lost, frozen or recovered.

The next useful update would supply a new observation with that context: a changed balance at a stated time, a newly documented restriction on assets, or evidence identifying what happened after the reported CoinJoins. Until then, the supported news is Elliptic's approximately $3.24 billion linked-address estimate and its observation of about 28 BTC in 18 mixing transactions.

Quick answers

Does $2.85 billion frozen or seized mean customers have been repaid?

Elliptic reports restrictions on assets, without establishing completed customer repayments. A repayment claim needs its own evidence about the recipient and process.

Does the activity prove AI agents were involved?

Elliptic says the observed behavior supports conventional automation and provides no evidence of AI agents making decisions.

Does 28 BTC describe all remaining assets?

The figure describes bitcoin in 18 CoinJoins by 14:02 SGT on November 2. The broader linked-address balance includes mainly ETH and BTC.