Exchange Hacked: How Stolen Crypto Moves and How to Avoid Receiving Tainted Funds

01What happened — and what is still unclear

In late October 2026 Binance reported a record hack. Media estimates put the losses at roughly $6.3–6.4 billion. The exchange said it had set aside $6.34 billion of its own money to cover them and that customer funds were not affected; about $3 billion was reported frozen together with partners. Several outlets, citing blockchain-analytics firms and Reuters, attribute the attack to the same group behind the Bybit breach, reported as North Korea-linked.

These figures and the attribution come from news reports and the company's own statements, and they may change as the investigation continues. We use them only as context: nothing below depends on who is behind the hack.

What does not change is what happens next. The same pattern follows every large theft, from the Bybit breach to the next one — and it is the pattern that matters to anyone who deals in crypto.

02How stolen crypto usually moves

Thieves do not hold stolen funds; they try to make the trail long and confusing before cashing out. The typical stages, in plain terms:

Splitting

The funds are spread across many fresh addresses so no single transfer looks large.

Swapping

Coins that can be frozen (such as stablecoins) are swapped for ones that are harder to freeze.

Bridging

The funds hop between blockchains, so the trail has to be followed across several networks.

Mixing

Services that blend many users' funds so that the origin of a particular coin is hard to tell.

Cashing out

The last step: OTC desks, P2P deals and exchanges with weak controls. This is the point where honest people can be pulled in.

03Why honest users get hurt

Stolen funds are chased. Exchanges and issuers freeze what they can find: Tether can blacklist an address on-chain, and platforms hold deposits that look tied to a theft. In this case about $3 billion was reported frozen. The problem is that a freeze is applied to an address, not to a person. If you receive tainted coins, your address can be frozen, your deposit held and your account questioned — even though you only bought crypto.

A frozen address

The USDT or tokens on it cannot move. How to tell what froze your funds and who can fix it is in USDT frozen: why Tether blocks addresses and what to do.

A held deposit

A platform's compliance team asks where the money came from. The response plan is in failed an AML check: what to do next.

A bad P2P deal

Sellers who offer funds well below the market price, or in a hurry, are often unloading something they cannot cash out themselves.

04How an AML check shows a link to a hack

An AML check reads what the data provider already knows about an address and the funds around it. Three parts of the result matter here:

The “illicit activity” category

It covers theft and hacks, scams and fraud, darknet services and addresses blacklisted by Tether. A mark here is the first thing to look for. The categories are explained in what a crypto wallet AML check is.

“Linked to a known hack”

When the provider has attributed an address to a specific hack event, the full report names it. The free first check shows the score and level; the category breakdown and this label open with a paid check.

Direct or indirect, and how far

A direct link is a strong warning. An indirect one several transfers away, with a small share, is usually background noise — see direct vs indirect exposure and why a wallet can show high risk when its owner did nothing wrong.

05Before you accept funds: a short routine

1. 01Ask for the sender's address before the deal, not after the money arrives.
2. 02Run an AML check on it — the steps are in how to do an AML check on a wallet. For stablecoins see the USDT AML check.
3. 03Read the categories and the “linked to a known hack” label, not just the score.
4. 04Look at how direct the link is, how many transfers away it sits and what share of the funds it covers.
5. 05Be wary of the usual signs: a price well below the market, urgency, an odd intermediary, or a request to forward the money on.
6. 06For a large amount, re-check just before the transfer — labels update as investigators work.
7. 07Keep the report and the deal chat. They are your record of due diligence.

The same routine for large USDT transfers, with what exchanges usually ask for, is in how to transfer a large amount of USDT safely.

06If you already received tainted funds

Stop and do not forward the funds

Moving them on through new addresses can look like laundering and turns an unlucky buyer into a suspect.

Keep the evidence

The chat, the deal terms, the transaction hashes and an AML report on the sender's address.

Check what you can

Run a check on the sender and on the address where the funds now sit, so you know what a platform would see.

Use the right channel

If a platform is holding the funds, answer its questions through its official support. The documents to prepare are in what to put in a source-of-funds file.

Talk to a lawyer for a large sum

A lawyer who knows crypto in your jurisdiction can tell you what to report and to whom. This article is general information.

07What an AML check cannot do

• It cannot find every stolen coin. It shows what the data provider has attributed; funds that have not been labelled yet look clean.
• It is not proof of guilt. A link to a hack means the funds passed near it; it says nothing about the owner's intent.
• It does not trace a specific hack for you. We report the provider's result as returned and never present missing data as “clean”.
• A clean result is a snapshot, not a guarantee. New transfers and new attributions can change it.

A check costs far less than a frozen balance — see what an AML check costs. How the score is built is on the methodology page.

This article is general information, not legal advice, and facts about the hack are taken from news reports and company statements that may change. AML Check Hub screens addresses against available third-party blockchain intelligence and reports the result as-is: a high-risk result is a strong warning sign, not a final legal determination, and a clean one is information, not a guarantee.