When I first saw the latest figures on the massive exchange breach, one detail stood out more than the rest. Roughly 28 Bitcoin, worth about $2.2 million at the time, had started moving through a series of CoinJoin transactions. It does not sound like much next to the overall haul, yet it marks a clear shift in how the stolen funds are being handled. The rest of the money, still valued around $3.24 billion, sits in tracked addresses that investigators continue to watch closely.
How The Hacker Began Mixing Converted Bitcoin
The mixing activity started quietly. Blockchain analysts noticed the first CoinJoin transfers just after 05:55 UTC on November 1. Bitcoin that had originally come from stolen Tron assets entered those privacy transactions. Later, some Ethereum was swapped into Bitcoin and followed the same path. By early the next morning the count reached 18 separate CoinJoin rounds involving that 28 BTC total.
CoinJoin works by combining inputs from multiple users into a single large transaction. The outputs then go out to new addresses, which makes it much harder to connect any specific incoming coin to a specific outgoing one. In this case the protocol used was WabiSabi, the same one powering certain well-known privacy wallets. From an investigator’s point of view that choice is both expected and slightly frustrating. Expected because anyone trying to break the trail would reach for the strongest available tool. Frustrating because it raises the difficulty of following every satoshi.
Interestingly, the large pile of Bitcoin taken directly from the exchange, reported at around 18,270 BTC, has stayed put in just 19 addresses. None of that original Bitcoin has entered the mixers so far. The coins that did move through CoinJoin came from later conversions of other stolen assets. That separation matters. It suggests the operator is treating different parts of the haul with different levels of urgency or caution.
Why Only A Small Slice Has Moved Into Privacy Tools
Twenty-eight Bitcoin is a tiny fraction of what was taken. Analysts who examined the flow estimate that almost nothing has been successfully cashed out yet. The $3.24 billion figure they quote refers to balances still sitting in addresses that can be linked back to the original theft. It does not mean every one of those wallets is under the same person’s active control right now, only that the coins remain visible and connected on the public ledgers.
In my experience watching these cases, the early mixing stages often serve as a test. The operator may be checking whether the CoinJoin rounds complete cleanly, how long the funds stay in the pool, and whether any monitoring services flag the outputs. Once that test looks successful, larger amounts can follow. Or the operator may decide the risk is still too high and leave most of the funds untouched for months.
Either way, the current picture shows patience more than panic. The bulk of the stolen value has not been rushed into tumblers or bridges. That patience can work in two directions. It gives investigators more time to build cases and pressure points, yet it also gives the thief time to wait for attention to fade.
The Scale Of Frozen And Seized Assets
Earlier tracking put the total theft near $6.43 billion, a bit higher than the exchange’s first public estimate. Of that amount, roughly $2.85 billion has been frozen or seized. That works out to about 44 percent. Most of the restricted funds were stablecoins. Issuers of those tokens stepped in quickly, and certain layer-two networks used their governance tools to lock affected balances.
Native assets proved harder to stop. Nothing taken on Bitcoin itself, the XRP Ledger, Solana or NEAR appears to have been frozen in the same way. That difference is structural. When a token is issued by a company that can blacklist addresses, recovery becomes possible. When the asset is native to a chain designed for censorship resistance, the options shrink dramatically.
The distinction between issuer-controlled tokens and truly native cryptocurrencies becomes painfully clear the moment a large theft occurs.
Stablecoins made up 94 percent of the frozen portion. That concentration is no accident. They are the easiest assets for issuers to restrict, and they formed a huge part of the original take. Four categories alone accounted for roughly three-quarters of the total loss: Ethereum-based USDT, Bitcoin, USDC, and Tron-based USDT. The Ethereum portion alone ran close to $3.8 billion across 186 different tokens.
Patterns Seen In The Early Tron Transfers
Before any CoinJoin activity appeared, investigators watched a different pattern on Tron. A distribution wallet pushed funds out every hour for 31 straight hours. No overnight pause. The receiving wallets usually moved the money onward within about two minutes. Amounts stayed consistent and the timing looked mechanical. When a bridge refused a deposit, the same funds were resent from newly created wallets toward the same destination.
By late October the main distribution wallet had already sent out roughly $196 million across about 200 addresses. Overnight rates sat between $7 million and $11 million per hour. Those numbers point strongly toward automated software rather than a person clicking buttons by hand. Automation is efficient, but it also creates a fingerprint. Regular intervals and repeated amounts help analysts cluster the related addresses even when new wallets appear.
For any service that screens incoming deposits, the lesson is clear. A wallet can look clean at one moment and receive tainted funds a few hours later. Continuous monitoring beats a single snapshot every time.
How The Exchange Is Replacing Stolen Assets
While investigators chase the stolen coins, the exchange itself has taken a different route. It committed more than $6.34 billion of its own capital to replace the missing user assets. At one point $5 billion of that was already sitting in the matching cryptocurrencies. A later update put the replenishment process near 90 percent complete.
The remaining purchases involve smaller and less liquid tokens. Those can take longer to acquire without moving the market too much. Funding for the effort has come from the company’s Secure Asset Fund for Users, part of its futures insurance arrangement, and from general company reserves. The futures insurance fund itself sits outside the regular proof-of-reserves calculations because it belongs to the company rather than to individual users.
This approach protects customers in the short term. It does not recover the original coins, of course. Those remain the subject of ongoing tracking. Still, the decision to cover the loss with company money sends a strong signal about priorities. Users get their balances restored while the longer fight over the actual stolen assets continues in the background.
What CoinJoin Really Changes For Investigators
CoinJoin does not make funds disappear. It makes the graph harder to read. Each round adds uncertainty about which output belongs to which input. When the same coins go through multiple rounds, that uncertainty multiplies. Yet every transaction still sits on a public ledger. Timing, amounts, and fee patterns can still leak information. Cluster analysis and heuristics continue to evolve, so the privacy gain is real but rarely absolute.
In this specific case the volume mixed so far remains modest. That keeps the statistical cover thinner than it would be inside a large, busy pool. A bigger volume of genuine users joining the same transactions would improve the privacy for everyone involved, including the thief. The current size of the operation suggests either caution or limited access to deep liquidity at the moment.
I have watched similar mixing campaigns in past incidents. The ones that succeed usually spread the activity over weeks or months and vary the amounts and timing. The ones that fail often try to move too much too quickly and create obvious spikes that monitoring tools catch. The present activity looks closer to the careful end of the spectrum, at least for now.
Attribution And The Broader Context
Official statements have linked the breach to a known North Korean group that specializes in large crypto thefts. That attribution rests on technical indicators and past patterns rather than public courtroom evidence so far. Groups of that type have shown a preference for patient, multi-stage laundering. They often sit on funds for long periods, convert them through multiple chains, and only later attempt to cash out through complex networks of intermediaries.
The current CoinJoin steps fit that general approach. Small tests, conversion of non-Bitcoin assets into Bitcoin, and the use of established privacy tools all match previous behavior observed in similar campaigns. Whether the same actors remain in full control of every wallet is harder to confirm. Funds can change hands inside closed groups, and some addresses may simply be temporary staging points.
Practical Lessons For Everyday Users And Services
Most readers will never face a multi-billion-dollar breach. Still, the episode highlights a few practical points that apply more widely.
- Stablecoins can be frozen by issuers in ways that native assets cannot. That is a double-edged sword depending on your priorities.
- Automated transfer patterns leave clearer trails than irregular human behavior. Anyone moving large sums should expect that reality.
- Services that accept deposits need continuous screening rather than one-time checks. Tainted funds can arrive after an address has already been approved.
- Company-funded reimbursement can restore user balances quickly, yet it does not solve the underlying security failure.
- Privacy tools raise the cost of tracking but rarely erase every link when enough resources are applied over time.
Those points are not theoretical. They come directly from the patterns visible in this single case. The more exchanges and users internalize them, the harder future large-scale thefts become.
Where The Tracked Funds Stand Today
As of the latest available analysis, the $3.24 billion figure still describes assets that remain connected to the original theft on public chains. That number can change quickly. Coins can move into mixers, bridges, or dark-market services. They can also sit idle for long stretches. The fact that only a small Bitcoin amount has entered CoinJoin so far does not guarantee the rest will stay quiet.
Investigators continue to map the broader wallet set. Thousands of addresses across multiple chains have already been examined. Each new transfer adds data points that can tighten or loosen earlier clusters. The work is painstaking. It also improves with every additional piece of information about timing, counterparties, and conversion paths.
Perhaps the most interesting aspect is how little has actually left the public view. Despite the size of the original theft, the overwhelming majority of the value remains visible and linked. That visibility is both a vulnerability for the thief and an opportunity for those trying to recover or restrict the funds.
Looking Ahead At Possible Next Moves
Several paths remain open. The operator could continue slow CoinJoin rounds and gradually increase the volume. Larger amounts could move into other privacy protocols or cross-chain bridges. Some portion might be parked in DeFi protocols under the guise of ordinary yield farming. Or the funds could simply remain dormant while attention shifts elsewhere.
Each choice carries trade-offs. Faster movement raises detection risk. Longer dormancy increases the chance that more addresses get frozen or that law-enforcement pressure intensifies. The decision will depend on the operator’s risk tolerance, available infrastructure, and assessment of current monitoring intensity.
From the outside it is impossible to know which path will be chosen. What is clear is that the first mixing steps have already been taken. The quiet period that followed the initial large transfers is ending, at least for a small slice of the Bitcoin portion.
Why This Case Matters Beyond The Numbers
Large exchange breaches test more than technical defenses. They test the resilience of the broader ecosystem. When an exchange can replace billions in user assets with its own capital, confidence receives a temporary boost. When nearly half the stolen value can be frozen through issuer and network actions, the practical limits of decentralization become visible. When privacy tools are used on only a tiny fraction of the haul, the difficulty of truly disappearing large sums becomes equally visible.
I keep coming back to that tension. Crypto systems promise both censorship resistance and transparency. In a theft of this size those two properties pull in opposite directions. The transparent parts help trackers. The resistant parts help the thief. The outcome of any individual case depends on which force gains the upper hand at each stage.
This particular episode is still unfolding. The CoinJoin activity is recent. The bulk of the funds remains in place. Recovery efforts continue on several fronts. What happens in the next weeks and months will add another chapter to the long record of major crypto thefts and the responses they provoke.
For now the story is straightforward enough. A small amount of converted Bitcoin has entered privacy transactions. A much larger amount stays under observation. Frozen assets already account for a substantial share of the original loss. And the exchange itself has stepped in with its own money to make users whole. Those facts form the current baseline. Everything else is still in motion.
The Human Side Of Tracking Stolen Crypto
Behind every wallet address sits a chain of decisions. Someone chose the timing of the first CoinJoin. Someone decided which assets to convert and which to leave untouched. Someone wrote or configured the scripts that pushed funds out every hour on Tron. Those choices leave traces even when the individuals remain hidden.
On the other side sit the analysts who spend long hours clustering addresses, the exchange teams working to restore balances, and the users who woke up to the news that their assets had been part of a historic breach. The technical details matter, yet the human stakes remain just as real. Confidence in custodial services, the practical reach of issuer controls, and the ongoing contest between privacy tools and tracking methods all affect real people and real balances.
That is why cases like this continue to draw attention long after the initial headlines fade. They reveal the current balance of power between those who move funds and those who follow them. Right now that balance still favors visibility more than complete disappearance, at least for the majority of the stolen value. Whether the recent CoinJoin steps begin to tip the scale remains an open question that only time and further on-chain activity can answer.
The coming days will show whether the 28 Bitcoin were a one-off test or the start of a larger mixing campaign. Until then the rest of the $3.24 billion continues to sit in plain sight on the ledgers, waiting for the next move.
