Binance Hack Update: Arbitrum Moves $30M As Hackers Turn To Bitcoin CoinJoin

• Arbitrum’s Security Council moved about $30 million in Binance-linked ETH and ARB without the exploiter’s private key.
• Elliptic detected the first CoinJoin activity involving Bitcoin linked to the Binance hack, with around 28 BTC processed by November 2.
• Approximately $2.85 billion of the reported $6.43 billion theft had been frozen or seized, while around $3.24 billion remained linked to the attackers.

The aftermath of the $6.43 billion Binance hack has taken a turn. Arbitrum moved assets linked to the exploit into a holding address. Investigators found new ways to hide the stolen assets.

Blockchain analytics firm Elliptic says about $2.85 billion of the stolen assets have been frozen or seized, while around $3.24 billion remain linked to the attackers.

Arbitrum Moves $30M Without Hacker’s Private Key

On October 30, Arbitrum’s 12-member Security Council transferred more than 8,425 ETH and 74 million ARB, worth approximately $30 million, from an address associated with the Binance exploit.

The Arbitrum Security Council has taken emergency action to rescue the 74,559,805 ARB and 8,425 ETH being held in the address on Arbitrum One that is identified as connected to the Binance exploit. The Security Council acted by weighing its commitment to the security and integrity of the Arbitrum community and Arbitrum governance without impacting any Arbitrum users or applications.

After significant technical diligence and deliberation, the Security Council identified and executed a technical approach to move funds to safety without affecting any other chain state or other Arbitrum users.

As of October 30, 2026 time, the funds have been successfully transferred to an intermediary frozen wallet. They are no longer accessible to the address that originally held the funds, and can only be moved by further action of the Security Council or a vote of Arbitrum DAO governance, which will be coordinated with relevant parties.

— Arbitrum (@arbitrum) October 30, 2026

The council temporarily modified Arbitrum’s Inbox contract using its emergency upgrade powers. The replacement code introduced a function that allowed transactions to be processed as originating from the exploiter’s address without requiring its private key.

The assets were transferred to a holding address ending in 0DA0 before the original contract code was restored. Arbitrum said no other users’ funds or applications were affected. The funds can only be moved again through an ArbitrumDAO governance vote, according to the council’s notice.

Binance hack update: the laundering is running on conventional automation, with about 12,000 wallets on 11 blockchains and more than 40,000 transactions in under four days.

➡️ $3.24 billion still sits in linked addresses, mostly ETH and BTC
➡️ $2.85 billion has been frozen
➡️ The first mixing has started, with about 28 BTC ($2.2 million) run through Wasabi-style coinjoins

Read the full analysis: https://t.co/Pji11JRd4x

— Elliptic (@elliptic) November 2, 2026

While the intervention could help secure stolen assets, it also raises questions about decentralization and the extent of control network administrators can exercise through emergency upgrades.

Binance Hackers Use CoinJoin To Mix Bitcoin

Meanwhile, Elliptic reported the CoinJoin activity that was linked to the Binance theft and involved Bitcoin. The activity started on November 1. It used the WabiSabi protocol, which is a Bitcoin mixing tool that works with wallets like Wasabi Wallet.

CoinJoin mixes transactions from multiple people, making it harder to link the money that goes in with the money that comes out. By November 2, 28 BTC, worth roughly $2.2 million, had moved through 18 CoinJoin transactions.

Investigators also watched assets that moved across networks. The activity involved swaps, cross-chain bridges, lending vaults, and transfers to wallets that were created very recently. Elliptic estimated that the whole operation spanned 11 blockchains, used 12,000 wallets, and included over 40,000 transactions.

Stay informed with the latest trends in Web3, blockchain innovation, and cybersecurity updates at 3verseTV

You need to login in order to Like