Blockchain analytics firm Elliptic disclosed that about $3.24 billion of assets stolen from Binance remains in addresses associated with the incident, while some funds have been moved through mixing services; the disclosure also covers the scale of remaining stolen assets, freezing status and mixing progress.
Blockchain analytics firm Elliptic disclosed that about $3.24 billion of the assets stolen from Binance remains in addresses associated with the incident, while some funds have already been moved through mixing. The disclosure also covers the scale of remaining stolen assets, freezing status and mixing progress. This is an important information update in the tracking of the Binance security incident, extending market attention from a single loss figure to multiple stages including asset retention, freezing and transfers.
As an on-chain analytics firm, Elliptic's disclosure focuses not on price action but on the on-chain retention status and transfer progress of the stolen assets. Its content centers on balances at associated addresses, mixing transfers and freezing status. In terms of incident positioning, the Binance theft involved a relatively large amount; this disclosure further updates information on asset whereabouts and indicates that on-chain tracking of the stolen assets is still ongoing.
In terms of asset scale, about $3.24 billion is still in associated addresses, a figure that constitutes the currently visible scale of remaining stolen assets. Associated addresses are an important clue for determining whether stolen assets can still be traced. A large amount of assets remaining in associated addresses means that at least part of the incident-related funds is still within the scope that on-chain analysis can identify and continuously monitor. For a security incident, whether balances at associated addresses change, whether funds continue to be transferred out, and whether new address consolidation appears are all important signals for observing the progress of asset handling. This disclosure confirms the fact that assets remain in associated addresses, providing a baseline coordinate for subsequent tracking.
Alongside the associated-address information, some funds have already been moved through mixing. This indicates that the stolen assets are not all sitting in original or associated addresses; rather, a portion has entered the mixing transfer process. Mixing changes the on-chain path of funds and increases the complexity of subsequent tracking. Market attention to this development is mainly focused on the scale of funds already transferred, the transfer path, and whether they can still be identified and tracked. What can currently be confirmed is that mixing transfers have occurred, but existing information does not reveal the specific amount or proportion, so the impact of the mixing stage can only be assessed qualitatively.
The disclosure also addresses freezing status. Freezing is one of the key stages in handling a security incident and directly relates to whether assets remain within a controllable scope. This disclosure incorporates freezing status into the incident tracking framework, indicating that, in addition to asset retention and mixing transfers, restrictions on some assets are also currently under scrutiny. However, the specific scale of frozen assets, the executing entities, the range of covered addresses, and the relationship between frozen assets and the roughly $3.24 billion in associated-address assets have not been further clarified in the available information.
Overall, the roughly $3.24 billion still in associated addresses, the portion of funds moved through mixing, and the disclosure's mention of freezing status are not isolated facts. The scale of remaining assets answers how much is still within an observable scope; mixing transfers answer whether any funds have left the direct tracking path; freezing status answers whether some assets are subject to restrictions. Together they form the main factual framework for current incident tracking. In the absence of more granular data, this framework can still help the market understand the incident's progress in terms of both scale and status.
The value of on-chain analysis lies in continuously confirming whether assets remain in identifiable addresses. The disclosure's statement that about $3.24 billion remains in associated addresses indicates that although funds have moved since the incident, a considerable amount has not left the scope of associated addresses. This information is of reference significance for asset recovery, because as long as assets remain in identifiable addresses, there is still room for subsequent handling and tracking. At the same time, some funds entering mixing transfers suggests that different portions of the assets may face different tracking difficulties. This difference means the incident's handling cannot be reduced to a single outcome.
Beyond the confirmed facts above, the disclosure has not yet stated the time of the incident, Binance's latest response, whether law enforcement agencies have intervened, the specific number of associated addresses, the distribution of funds and transfer paths, or the names of mixing tools or service providers, nor the specific amount and proportion of assets already mixed. These information gaps mean that currently only the factual framework of roughly $3.24 billion still in associated addresses, some funds already mixed, and the existence of freezing status can be confirmed; no quantitative judgment can be made about the outcome of asset recovery or the scale of mixing. Current analysis should be strictly limited to the disclosed facts.
Going forward, attention can be paid to whether Elliptic updates the balances of assets at associated addresses and the proportion moved through mixing, whether the scope and specific amount of frozen assets are further clarified, whether new fund movements appear at relevant addresses, and whether Binance or relevant security agencies provide further statements on asset recovery progress. The above information will affect the market's assessment of the handling progress of this security incident. This article is an objective summary based solely on currently available public information and does not constitute investment advice.
.jpg)
