Where Does $6.4 Billion In Stolen Crypto Go And What Does It Take To Track Down The Money?

After $6.4 billion in crypto disappeared from Binance accounts towards the end of last week,  one might assume the money would be almost impossible to find. After all, unlike traditional bank transfers, cryptocurrency can move between digital wallets, cross international borders in seconds and pass through multiple blockchain networks without necessarily involving a conventional financial institution.

But the one significant problem crypto thieves face is that cryptocurrency transactions leave a trail. Following the recent $6.4 billion Binance hack, investigators and blockchain analytics firms have been working to trace the stolen assets, identify where they’re moving and prevent the attackers from cashing out. And according to blockchain intelligence firm Elliptic, approximately $2.85 billion has already been frozen or seized, representing around 44% of the stolen funds.

The FBI has since attributed the attack to North Korea’s state-sponsored TraderTraitor hacking group, although the investigation into the movement of the money is far from over.

So, where does stolen cryptocurrency actually go, and how difficult is it to get it back?

Following the Money: How Stolen Crypto Is Tracked

One of the biggest misconceptions about cryptocurrency is that transactions are completely anonymous. The reality is that most public blockchains maintain a permanent, publicly accessible record of transactions. Investigators can follow funds between wallets, identify patterns and establish connections between addresses, even when they don’t immediately know who controls them.

The challenge, however, is that criminals can, in theory, make this process considerably more complicated. Stolen assets can be split across hundreds or thousands of wallets, exchanged for different cryptocurrencies or transferred between blockchain networks by means of cross-chain bridges. These movements can certainly make the trail harder to follow, but they don’t necessarily make it disappear.

Ryan Kirkley, Co-Founder and CEO of Global Settlement Network (GSN), explains that moving such a substantial amount of cryptocurrency without leaving a trace is incredibly difficult. As he told us, “The hackers can split funds across thousands of wallets, swap assets and move between networks, but none of that makes the transaction history disappear.”

Jonathan D. Steele, Founder at Steele Fortress, makes a similar point, explaining that investigators can follow transactions but that recovering the assets is an entirely different challenge. “The money can be followed, because every move on a public blockchain is recorded. Getting it back is the hard part.”

Finding the Money Doesn’t Mean Getting It Back

As several experts explained to us, tracking the money is one thing, but getting it back is another issue entirely. While blockchain analytics can help investigators identify where stolen assets are held, actually recovering them often requires intervention from third parties.

For example, stablecoins like Tether’s USDT and Circle’s USDC are issued by companies that can freeze certain tokens when they identify suspicious activity. Crypto exchanges can also freeze accounts or prevent withdrawals when stolen assets reach their platforms.

However, Bitcoin and Ether operate differently, because they don’t have a central issuer that can simply freeze someone’s balance. Rodion Sorokin, Co-Founder and CTO of The Capital Index, explains that investigators need to wait for stolen assets to reach somewhere they can actually be stopped. According to Sorokin, “The rest is Ether and Bitcoin, which nobody can freeze, so investigators wait for the money to touch a chokepoint, such as an exchange, an OTC desk or a bridge, where it can be stopped.”

This is why the speed of the initial response is absolutely vital. Once assets have been converted into cryptocurrencies that can’t be frozen by a central issuer, recovery becomes a whole lot more difficult.

The Complications of International Crypto Investigations

There’s also a legal and international that needs to be considered when it comes to crypto fraud. Daniel Schatz, Political Scientist, Author and International Affairs Expert, says North Korea’s suspected involvement makes the incident particularly significant, given the country’s alleged use of cryptocurrency theft to support its sanctioned regime and weapons programmes. He explains that identifying the wallets holding stolen funds doesn’t automatically give investigators the authority to seize them. “Investigators may identify a wallet without having the private keys or jurisdictional cooperation needed to seize its contents,” Schatz explained. Unsurprisingly, this is made even more challenging when funds move across multiple jurisdictions or into services that are difficult for authorities to access.

Safi Ghauri, Managing Partner at Esquare Legal, who has experience in tracking and freezing digital assets, points to another complication in the mix, which is that some of the stolen funds have been mixed with cryptocurrency linked to a separate Bitget exploit: “We might be able to trace all the funds, but recovery is extremely difficult unless a cross-governmental agency gets involved and we see unprecedented global cooperation.”

How Much of the Stolen Cryptocurrency Can Actually Be Recovered?

Despite the challenges, the initial recovery figures are significant and worth highlighting. Elliptic estimates that approximately $2.85 billion has been frozen or seized, however, that doesn’t mean all of it’s actually been returned. Some assets remain locked in complex positions, while other funds continue moving through different wallets and networks.

And perhaps more importantly, even when investigators know where the remaining cryptocurrency is, they can’t necessarily do anything about it immediately. Steele believes that the majority of whatever is ultimately recovered may already have been frozen, while Sorokin similarly expects the remaining funds to be moved gradually over the coming months.

The Binance incident has shone light on the fact that cryptocurrency’s public transaction records can make large-scale thefts surprisingly traceable, but unfortunately, visibility isn’t the same as control.

As Kirkley puts it, “Finding a wallet is one thing. Getting control of the assets is another.”  A little bit like finding a hidden treasure chest without a key to get it open.

Comments from the Experts:

• Ryan Kirkley: Co-Founder and CEO of Global Settlement Network (GSN)
• Jonathan D. Steele: Founder at Steele Fortress
• Daniel Schatz: Political Scientist, Author and International Affairs Expert
• Safi Ghauri: Managing Partner at Esquare Legal
• Rodion Sorokin: Co-Founder and CTO of The Capital Index

Ryan Kirkley, Co-Founder and CEO of Global Settlement Network (GSN)

“The thing about stealing $6.4 billion in crypto is that you then have to figure out what to do with it. Moving that much money without leaving a trail is incredibly difficult, especially when every transaction is recorded on a public blockchain.

“The hackers can split funds across thousands of wallets, swap assets and move between networks, but none of that makes the transaction history disappear. Investigators have sophisticated tools to follow those movements, and I’d expect a substantial amount of the stolen funds to be traced.

“The better question is how much can actually be recovered. Finding a wallet is one thing. Getting control of the assets is another, particularly when you’re dealing with Bitcoin or Ether, where there’s no issuer that can simply freeze a balance.

“I think the recovery will come down to speed, coordination and where the hackers eventually try to cash out.”

Jonathan D. Steele, Founder at Steele Fortress

“The money can be followed, because every move on a public blockchain is recorded. Getting it back is the hard part. Thieves split funds across hundreds of wallets, swap tokens and hop between blockchains to break the trail, then try to cash out through brokers and exchanges. Recovery happens at chokepoints: stablecoin issuers that can freeze tokens, and exchanges that can lock an account once a wallet is flagged.

“That is why the freezes in the first hours and days matter most. After that, expect a long tail, with funds sitting dormant for months and then moving in small amounts. For a theft this size, I’d expect what was frozen early to be most of what is ever recovered. A blockchain never forgets, but it can’t freeze a single coin on its own.”

Daniel Schatz, Political Scientist, Author and International Affairs Expert 

“North Korea is suspected of involvement in the Binance theft, although its responsibility has not been confirmed. If established, this would fit a broader pattern of cryptocurrency theft supporting the sanctioned regime and its weapons programmes.

“Investigators follow public blockchain transactions, identify connected wallets and alert exchanges and stablecoin issuers that can freeze assets. But locating funds is different from recovering them: investigators may identify a wallet without having the private keys or jurisdictional cooperation needed to seize its contents.

“Elliptic reports that approximately $2.85 billion has already been frozen or seized. That does not mean it has been returned. Further recovery depends on intercepting funds as they pass through cooperative services. Substantial additional tracing is likely; full recovery remains uncertain. The central challenge is turning a visible financial trail into assets authorities can actually recover.”

Safi Ghauri, Managing Partner at Esquare Legal 

“I am a crypto lawyer and have been involved in high-level cases of tracking and freezing and unfreezing USDT and various digital assets.
Finding this money and getting it back are two very different challenges. The money is already clearly in several wallets that we all know and can see on the blockchain. Some was left as is, most converted to ETH, and a significant amount was swapped for TRX and then bridged. A lot of these funds have then been mixed with Bitget-exploited funds, making the job of investigators even more difficult.

“The best recovery opportunities come when funds reach an exchange that can freeze an account, or remain in tokens whose issuers can block transfers. Reports say that $2.85 billion in USDT and USDC have already been frozen or seized, although that does not mean it has been returned. A further complication is that frozen funds are in Aave where they were deposited and eth was borrowed in lieu.

“We might be able to trace all the funds but recovery is extremely difficult unless a cross-governmental agency gets involved and we see unprecedented global cooperation.”

Rodion Sorokin, Co-Founder and CTO of The Capital Index

“Tracking the money is the easy part; getting it back is the hard part. Every move on a public blockchain is visible, and analytics firms tied the Binance funds to North Korea within hours. The fastest recovery has already happened: stablecoin issuers can freeze tokens, and Tether and Circle froze about $3 billion. The rest is ether and bitcoin, which nobody can freeze, so investigators wait for the money to touch a chokepoint, such as an exchange, an OTC desk or a bridge, where it can be stopped. North Korea knows that and moves fast: after the Bybit hack, 20% of the stolen funds had ‘gone dark’ within two weeks and only 3% had been frozen. My expectation is that most of what will ever be recovered is already frozen; the rest will leak out slowly over months.”