Aftermath of the suspected Binance hack has entered a new and more complex phase as on‑chain analysts report that wallets linked to the attacker have begun moving more than $1 billion worth of ETH into newly created addresses.
According to blockchain‑monitoring account OnchainLens, the transfers appear to be part of a coordinated laundering strategy that may involve Tornado Cash and other mixing protocols.
The movements come days after Binance confirmed it was investigating irregular outflows, prompting renewed scrutiny of centralized exchange security and the growing sophistication of post‑exploit laundering operations.
The suspected breach at Binance, triggered one of the largest emergency responses in the history of digital‑asset security. Stablecoin issuers Tether and Circle froze more than $2 billion in tokens linked to the attacker, preventing immediate liquidation and limiting the scope of the initial damage.
However, the attacker retained control of substantial non‑stablecoin assets, including large quantities of ETH, which could not be frozen at the protocol level. These assets are now at the center of a rapidly evolving laundering operation that analysts warn may take months to fully trace.
OnchainLens, which monitors high‑value exploit flows, reported that the attacker began consolidating ETH from multiple compromised wallets into fresh addresses shortly after the stablecoin freezes were announced.
The transfers were executed in batches, with each batch routed through a sequence of intermediary wallets designed to obscure the origin of funds.
The pattern resembles previous large‑scale laundering operations, including the 2022 Ronin Bridge exploit and the 2023 Curve Finance breach, where attackers used multi‑hop routing to fragment transaction trails before engaging mixers.
The scale of the transfers is unprecedented. More than $1 billion in ETH has already been moved, according to OnchainLens, with additional flows expected as the attacker continues reorganizing their holdings.
Analysts note that the attacker appears to be avoiding centralized exchanges entirely, likely due to heightened surveillance and cooperation between exchanges and law enforcement following the initial breach.
Instead, the attacker is preparing to use decentralized privacy tools, including Tornado Cash, which remains operational despite sanctions and enforcement actions.
The suspected use of Tornado Cash is important, as while the protocol is permissionless and cannot be shut down, its public association with high‑profile hacks has made it a focal point for global regulatory scrutiny.
If the attacker begins depositing large quantities of ETH into Tornado Cash, it will trigger automated alerts across multiple compliance platforms and may prompt additional law‑enforcement coordination.
However, mixers remain one of the few tools capable of breaking deterministic transaction trails, making them attractive to attackers seeking to liquidate stolen assets without detection.
The laundering phase also highlights the attacker’s operational sophistication. The wallet‑routing patterns identified by OnchainLens suggest that the attacker is using automated scripts to fragment transfers, adjust gas fees to avoid clustering heuristics, and distribute funds across multiple chains.
Multi‑chain strategem complicates forensic analysis, as investigators must track assets across bridges, wrapped‑token contracts, and liquidity pools. The attacker’s movements indicate familiarity with forensic‑avoidance techniques, including time‑based obfuscation and address‑reuse minimization.
Binance has not yet released a detailed post‑incident report, but the exchange has reiterated that user funds remain safe and that internal teams are cooperating with law enforcement. The exchange’s ability to recover assets will depend largely on whether the attacker interacts with identifiable off‑ramps.
Stablecoins have already been frozen, but ETH and other non‑custodial assets remain vulnerable to laundering. Binance’s response will likely include enhanced monitoring of incoming deposits, coordination with other exchanges, and collaboration with blockchain‑analysis firms.
