Hackers spread equivalent of 1.96 billion KWD theft across 10,000 wallets

More than 10,000 wallets. That’s how many digital addresses the hackers behind the $6.3 billion Binance theft used to hide their tracks, according to a new investigation.

If you’ve been following our earlier coverage of the Binance hack, you’ll remember the breach happened on 29 October and shook crypto users everywhere, including many who trade from Kuwait. A fresh report from the Wall Street Journal, published on 7 November, shows just how hard it has become to trace where the stolen money actually went.

How did the hackers move the money?

After stealing the funds, the attackers broke the total into thousands of smaller holdings. They then pushed portions of it through services that let people swap crypto assets between different blockchain networks, making the money harder to follow.

One of the main routes was THORChain, a decentralised exchange service. Chainalysis found more than $46 million in stolen assets passed through it in the first 72 hours after the attack. Those transactions alone generated over KD 61,000 (about $200,000) in fees for the people running the service.

Nearly $4 million also moved through Wasabi Wallet, a Bitcoin privacy tool built specifically to make transactions difficult to trace.

Why didn’t anyone just block the transactions?

The FBI asked cryptocurrency service operators, including those running THORChain nodes, to block any transactions linked to the stolen funds. Some transactions kept going through anyway.

Developers behind these decentralised services say their systems were never built to give any single operator control over individual transactions. That’s the whole point of decentralisation: no one person or company can simply flip a switch and stop a transfer. This has raised real questions about who, if anyone, is responsible when stolen money flows through these networks.

What did the second investigation find?

Separately, blockchain intelligence firm Bitquery published its own analysis on 7 November. It traced about $333 million in stolen crypto that was either laundered or moved towards services that convert crypto into cash, during the first week after the breach.

Bitquery found that around $208 million of that moved within just two and a half days of the hack. Its researchers also identified THORChain as a major route, tracing roughly $113 million through the service during the period they studied.

It’s worth knowing that Bitquery’s figures cover nine different blockchain networks and use a different method and time frame from the Journal’s report. The two sets of numbers shouldn’t be added together or treated as the same count. Bitquery also noted that much of the stolen Bitcoin and Ether is still sitting in wallets that investigators can identify.

So is the money coming back?

Stablecoin issuers and other organisations have managed to freeze a large chunk of the stolen funds. According to the Journal, about half the total has now been frozen.

Freezing crypto stops it from being moved further, but it doesn’t mean the money goes back to Binance or the people who lost it. Blockchain tracing firms believe the attackers still control close to $3 billion of the original haul.

The 29 October breach hit assets across several blockchain networks at once, which is why the recovery effort has needed international cooperation between exchanges, tracing firms and law enforcement.

What this means if you’re in Kuwait

Crypto trading has grown quietly among residents and citizens in Kuwait, even though the Central Bank of Kuwait has repeatedly warned against using cryptocurrencies for payments. If you hold funds on Binance or any similar exchange, this case is a reminder that even a platform of that size can be targeted, and that recovering stolen funds can take far longer than freezing them.

Anyone who had funds affected by the October breach should keep checking official Binance updates rather than relying on social media rumours, since the picture is still changing. Our earlier report on the scale of the hack has more background on how investigators first linked the breach to its size and origin.

Quick answers