Share this article

Stolen Binance Funds Still Being Laundered Through Mixers, Researchers Claim

Funds from Binance's May hack are still moving through a mixing service according to research firm Clain

Updated Sep 13, 2021, 11:18 a.m. Published Aug 9, 2019, 8:00 p.m.
binancesingapore

Binance's recent hacker has been diligently washing funds stolen from the exchange back in May.

Clain.io, a Luxembourg-cryptocurrency capital flows research team, says the 7,074 stolen coins are being laundered through mixing service Chipmixer. Clain says at least 4,836 bitcoins were laundered since June 12.

STORY CONTINUES BELOW
Don't miss another story.Subscribe to the Crypto Daybook Americas Newsletter today. See all newsletters

A bitcoin tumbling service mixes bitcoins with other users' coins. Since bitcoins are attached to the publicly verifiable blockchain, mixing services are used to obfuscate transaction histories that follow bitcoins around.

Chipmixer was overwhelmed with the funds, Clain states. From June 12 onward, the hacker dumped funds into the mixer with abandon.

"It was pretty straightforward to trace the hacker's subsequent steps as it is practically impossible to launder big volume of coins in a relatively short period of time. Thus, we were able to detect the initial pool of hacker's addresses," the company wrote.

Clain says that Chipmixer has never handled inflows of such high volume, leading them to conclude that most funds coming out of Chipmixer today are related to one owner, the Binance hacker.

Image via Clain.io

Address analysis shows the hacker further breaking his loot into smaller sums of around 10 coins. Breaking the lump sum into small mixed batches is one way to prepare for off-ramping cryptocurrencies into fiat. Clain says 150 clusters were detected during the active mixing period and further believes some 5,300 bitcoin have been clustered overall.

Of the 4,836 coins tumbled, Clain has identified 183 bitcoins from the hacker with another 814 very likely to be from the hacker.

Clain's analysis shows little evidence to indicate any of the coins have hit the open market.

Image via CoinDesk archives

More For You

Protocol Research: GoPlus Security

GP Basic Image

What to know:

  • As of October 2025, GoPlus has generated $4.7M in total revenue across its product lines. The GoPlus App is the primary revenue driver, contributing $2.5M (approx. 53%), followed by the SafeToken Protocol at $1.7M.
  • GoPlus Intelligence's Token Security API averaged 717 million monthly calls year-to-date in 2025 , with a peak of nearly 1 billion calls in February 2025. Total blockchain-level requests, including transaction simulations, averaged an additional 350 million per month.
  • Since its January 2025 launch , the $GPS token has registered over $5B in total spot volume and $10B in derivatives volume in 2025. Monthly spot volume peaked in March 2025 at over $1.1B , while derivatives volume peaked the same month at over $4B.

More For You

Bitcoin Faces Japan Rate Hike: Debunking The Yen Carry Trade Unwind Alarms, Real Risk Elsewhere

japan, flag. (DavidRockDesign/Pixabay/Modified by CoinDesk)

Speculators maintain net bullish positions in the yen, limiting scope for sudden JPY strength and mass carry unwind.

What to know:

  • Impending BOJ rate hike largely priced in; Japanese bond yields near multi-decade highs.
  • Speculators maintain net bullish positions in the yen, limiting scope for sudden yen strength.
  • BOJ tightening may contribute to sustained upward pressure on global yields, impacting risk sentiment.