Blockchain analytics firm Elliptic has identified approximately $2.2 million in Bitcoin linked to the October 29 Binance theft being moved through CoinJoin privacy transactions. According to Elliptic's November 2 investigation, the first mixing activity occurred at 05:55 UTC on November 1, and around 28 BTC passed through 18 CoinJoin transactions by 06:02 UTC on November 2.
The Bitcoin originated from assets converted following the original theft. Investigators identified transactions using WabiSabi, a protocol associated with Wasabi Wallet that allows multiple participants to combine their Bitcoin into shared transactions. This makes it harder to establish which outgoing coins correspond to particular incoming funds. However, CoinJoin does not remove transactions from the blockchain or make Bitcoin completely untraceable. Researchers can still examine transaction structures, timing, and connections with previously identified addresses.
Elliptic’s investigation covers approximately 12,000 wallets, 11 blockchains, and more than 40,000 transactions. The firm also reported that the 18,270 BTC stolen directly from Binance remained distributed across 19 addresses without further movement. The Bitcoin entering CoinJoin represents converted assets rather than direct transfers from those original Bitcoin holdings.
Elliptic estimated that approximately $3.24 billion in theft-linked assets remained in identifiable addresses. Its earlier assessment valued the October 29 incident at $6.43 billion, with approximately $2.85 billion in frozen or seized assets. Stablecoins accounted for 94% of the restricted funds, demonstrating how issuer-controlled digital assets offer additional intervention mechanisms. Tether and Circle can restrict certain tokens, while decentralized networks generally require different approaches to address illicit activity.
Binance has allocated more than $6.34 billion in company resources to replace affected assets, while blockchain investigators continue to monitor movements across multiple blockchains.
