Two crypto thefts follow same path: $6.36bn Binance heist and $106m suspected EU theft

Within a week, two crypto heists followed an identical pattern. The stolen funds travel a route governed primarily by the fear of having them frozen. Understanding this route clarifies what portion of the loot might be retrieved, what might stay lost, and why certain sums may later enter circulation.

The larger theft involved Binance. On October 29, about $6.36 billion was taken from the exchange's hot wallets across ten blockchains, with the bulk leaving in around 20 minutes, reported TRM Labs, a blockchain analytics firm. A hot wallet is an internet-connected wallet used to process withdrawals. The FBI blamed TraderTraitor, a North Korean hacking group, and it stands as the biggest crypto heist ever recorded.

The second incident is unconfirmed. On Monday, blockchain researcher ZachXBT reported that an unidentified EU entity potentially lost over $106 million from multiple exchange accounts on Sunday. Since neither the victim nor the exchanges have been named, it remains a suspected theft. Yet it is illustrative, as the funds seem to have followed the same path.

Step 1: Dump stablecoins as fast as possible

Stablecoins like Tether's USDT and Circle's USDC present the biggest obstacle for thieves. Their issuers can lock tokens in any designated wallet, effectively rendering stolen dollars unusable.

Exactly that unfolded in the Binance case. According to TRM Labs, Tether froze roughly 971 million USDT in the attacker's primary receiving wallet 37 minutes after the main sweep, and Circle froze 823 million USDC minutes afterward. Including freezes by Tether, Circle, Ripple, World Liberty Financial, and Arbitrum's Security Council, TRM estimates the total at around $2.7 billion. Binance reports about $3 billion.

The attacker rushed to beat those freezes and incurred substantial costs. TRM reports that about 325 million USDT went to market makers in exchange for roughly 122,300 ETH, suggesting a discount exceeding 10% compared to market price. Additionally, 60 million USDT was deposited as collateral on lending protocol Aave to borrow about 19,760 ETH. Accepting such a sizable haircut demonstrates how much the thief prioritized escaping a freeze.

The suspected EU incident began similarly. ZachXBT stated the funds left the exchanges in USDC and USDT, with the USDC converted to Ether.

Step 2: Break the trail and switch blockchains

Once the funds are in assets that issuers cannot freeze — mainly ETH and BTC — the aim becomes making them difficult to trace.

One technique is the peel chain. TRM reports that the 18,270 BTC stolen from Binance was divided into rounded amounts of 1,000 and 100 BTC within a single block, generating multiple smaller tracks rather than one obvious path. Automated activity was also detected, with funds moving back and forth among wallets — even addresses previously used — to obstruct analysis.

Another method is chain hopping. Cross-chain bridges transfer assets from one blockchain to another, compelling investigators to resume the trail on a separate network. In the smaller case flagged on Monday, on-chain analytical platform Onchain Lens noted that funds from a wallet associated with King — a Solana arbitrage bot — passed through multiple Solana wallets and later moved to Ethereum via the bridging service Mayan. King's operator has not verified a breach, but the pattern is a textbook case.

TRM observes that the early Binance laundering relied more on market makers and lending protocols than on the bridge-intensive approach seen after the $1.5 billion Bybit hack in 2025. The firm anticipates that bridges, swap services, and over-the-counter brokers will play roles in the subsequent phase.

Step 3: Disappear off-grid then cash out

The final stage focuses on breaking the public trace and turning cryptocurrency into usable cash.

The suspected EU theft illustrates the go-dark step vividly. ZachXBT reported that the money went through instant exchange platforms such as WellWallet and Kyrrex and was swapped to Monero via a service named Wagyu. Instant exchanges enable swift coin swaps, typically with less rigorous checks than large exchanges. Monero is a privacy coin: unlike Bitcoin or Ethereum, which record every transaction on a public ledger, it conceals senders, recipients, and amounts by default. Once assets are in Monero, tracking them on the blockchain becomes much more challenging.

The final step involves converting to cash, generally via over-the-counter brokers and organized laundering networks. CNBC quoted experts stating that these networks lower the likelihood of recovery. This phase may span weeks or months, which explains why stolen funds persist in moving well beyond the initial media attention.

Relevance for traders and investors

This path clarifies the distinction between what got frozen and what did not. Stablecoins were the portion that could be recovered. ETH and BTC were not recoverable. According to TRM, the Binance attacker still holds over 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion, which is beyond any issuer's authority to freeze.

This situation creates a potential market overhang. If significant quantities of that ETH or BTC eventually get sold, it would increase supply. The timing and method are unknown, and laundering typically occurs in small portions over an extended period, so it should not be viewed as an impending sell-off. It is an element to watch, not a prediction.

There is a demand aspect as well. Binance co-CEO Yi He stated that the exchange allocated over $6.34 billion of corporate money to cover the stolen assets, and news reports indicate that some of that will be purchased through OTC transactions and exchange trading.

For individual investors, the key lesson concerns where risk lies. This attack targeted Binance's own hot wallets, and Binance states it is absorbing the losses, so customers have not been notified of any losses. Still, it serves as a reminder that cryptocurrency held on any platform depends on that platform's security. Stablecoin freezes also have a dual nature: they aided in this case, but they demonstrate that issuers can control tokens in any wallet.

What to monitor next

• Movement from the attacker's ETH and BTC wallets: TRM is tracking the peel chain and consolidation wallets. Big transfers to exchanges or OTC desks would be the initial indication that stolen funds are being sold.
• Binance's root cause: The exchange has not released a comprehensive account of how its signing systems were breached. This is important for assessing whether other platforms share similar vulnerability.
• Confirmation of the EU case: If the victim or exchanges are identified, or a validated loss amount appears, the $106 million incident becomes a distinct story. Until then it remains a suspected theft.
• Updated freeze totals: Any alteration in the quantity frozen or returned changes the assessment of what still lies in the attacker's control.

What could alter the scenario: if the stolen ETH and BTC stay untouched for months, the overhang is less relevant in the short run. If big sums begin appearing on exchanges, it becomes a more immediate supply issue. In any case, monitoring the wallets is more productive than speculation.