Two crypto thefts in less than a week show the same playbook. Stolen crypto moves along a predictable path, and the path is shaped by one fear above all others: being frozen. Knowing that path helps explain how much stolen money can be recovered, how much cannot, and why some of it may eventually reach the market.
The big one is Binance. On 29 October, an attacker moved about $6.36 billion out of the exchange’s hot wallets across ten blockchains, most of it in roughly 20 minutes, according to blockchain analytics firm TRM Labs. A hot wallet is an internet-connected wallet an exchange uses to process withdrawals. The FBI has attributed the attack to TraderTraitor, a North Korean hacking group, and it is the largest crypto theft on record.
The smaller case is unconfirmed. Blockchain investigator ZachXBT said on Monday that an unnamed entity in the European Union may have lost more than $106 million from accounts at several exchanges on Sunday. Neither the victim nor the exchanges have been named, so treat it as a suspected theft. It is still useful, because the funds appear to have taken the same route.
Step 1: Get out of stablecoins, fast
Stablecoins such as Tether’s USDT and Circle’s USDC are the thief’s biggest problem. Their issuers can freeze tokens sitting in a specific wallet, which turns stolen dollars into dead weight.
That is exactly what happened at Binance. TRM Labs says Tether froze about 971 million USDT in the attacker’s main receiving wallet 37 minutes after the main sweep, and Circle froze 823 million USDC minutes later. Counting freezes by Tether, Circle, Ripple, World Liberty Financial and Arbitrum’s Security Council, TRM puts the total at roughly $2.7 billion. Binance has given a figure of about $3 billion.
The attacker raced those freezes and paid heavily to do it. TRM says about 325 million USDT was sold to market makers for roughly 122,300 ETH, implying a discount of more than 10% to the market price. Another 60 million USDT was posted as collateral on lending protocol Aave to borrow about 19,760 ETH. Accepting a large haircut tells you how much the thief valued escaping a freeze.
The suspected EU theft started the same way. ZachXBT said the funds were withdrawn in USDC and USDT and the USDC was swapped for Ether.
Step 2: Split the trail and hop chains
Once the money is in assets no issuer can freeze, mainly ETH and BTC, the goal shifts to making it hard to follow.
One method is the peel chain. TRM says the 18,270 BTC taken from Binance was split into round pieces of 1,000 and 100 BTC within the same block, creating many smaller trails instead of one large one. Investigators also reported automated activity, with funds sent back and forth among wallets, including addresses used earlier, to confuse tracing.
Another method is chain hopping. Cross-chain bridges move assets from one blockchain to another, which forces investigators to pick up the trail on a different network. In the second, smaller case flagged on Monday, on-chain monitor Onchain Lens said funds from a wallet linked to King, a Solana arbitrage bot, moved through several Solana wallets and then to Ethereum using the bridging service Mayan. King’s operator has not confirmed a compromise, but the pattern is a textbook example.
TRM notes the early Binance laundering leaned on market makers and lending protocols rather than the bridge-heavy route used after the $1.5 billion Bybit hack in 2025. It expects bridges, swap services and over-the-counter brokers to feature in the next stage.
Step 3: Go dark, then cash out
The final stretch is about breaking the public trail altogether and turning crypto into usable money.
The suspected EU theft shows the go-dark step clearly. ZachXBT said the funds passed through instant exchange services, including WellWallet and Kyrrex, and were converted into Monero through a swap service called Wagyu. Instant exchanges let users swap one coin for another quickly, often with lighter checks than a major exchange. Monero is a privacy coin: unlike Bitcoin or Ethereum, where every transfer sits on a public ledger, it hides senders, receivers and amounts by default. Once funds are in Monero, on-chain tracing becomes far harder.
The last step is converting to cash, usually through over-the-counter brokers and professional laundering networks. Experts quoted by CNBC said these networks reduce the chances of recovery. This stage can stretch over weeks or months, which is why stolen funds can keep moving long after the headlines fade.
Why it matters for traders and investors
The path explains the split between what was frozen and what was not. Stablecoins were the recoverable part. ETH and BTC were not. TRM says the Binance attacker still controls more than 420,000 ETH and 18,270 BTC, worth about $2.4 billion, beyond any issuer’s reach.
That creates a possible overhang. If large amounts of that ETH or BTC are eventually sold, it would add supply to the market. The timing and route are unknown, and laundering often happens in smaller pieces over a long period, so it should not be treated as an imminent sell-off. It is a factor to monitor, not a forecast.
There is also a demand side. Binance co-CEO Yi He has said the exchange set aside more than $6.34 billion of company funds to replace the stolen assets, and reports say part of that will be bought through over-the-counter deals and exchange trading.
For individual holders, the lesson is about where risk sits. This theft hit Binance’s own hot wallets, and Binance says it is covering the losses, so customers have not been told they lost money. But it is a reminder that crypto held on any exchange depends on that exchange’s security. Stablecoin freezes cut both ways too: they helped here, but they also show that issuers can control tokens in any wallet.
What to watch next
Movement from the attacker’s ETH and BTC wallets. TRM is monitoring the peel chain and consolidation wallets. Large transfers to exchanges or OTC desks would be the first sign stolen funds are heading for sale.
Binance’s root cause. The exchange has not yet published a full explanation of how its signing systems were compromised. That matters for judging whether other platforms face the same risk.
Confirmation of the EU case. If the victim or exchanges are named, or a confirmed loss figure emerges, the $106 million theft becomes a story in its own right. Until then it stays a suspected theft.
Updated freeze totals. Any change in how much has been frozen, or returned, shifts the estimate of what remains in the attacker’s hands.
What could change the picture: if the stolen ETH and BTC sit untouched for months, the overhang matters less in the near term. If large amounts start reaching exchanges, it becomes a more direct supply question. Either way, watching the wallets is more useful than guessing.
This article was written by Eamonn Sheridan at investinglive.com.
