Where's the $6 billion?

The loot, wallet by wallet

A crypto wallet is an address anyone can look up, like a bank account with its statements pinned to a wall. Each bag here is one of the thieves' wallets, sized by what it held at the start and filled to what's still in it. When the fill drops, the money has moved, and the list under it says where. Each bag opens that wallet on a public explorer.

Three more Tron wallets, filled by the main one on 30 October, were already empty when this page started watching.

What moved

Every time money leaves one of those wallets, it shows up here within 10 minutes, newest first.

1. Nothing yet. Before this page started watching, $38 to $67 million of the Tron money had already been swapped away, by Elliptic's count.

How stolen crypto gets away

Stealing it was the fast part. Spending it is hard, because every coin's history is public and exchanges turn away coins that are flagged. So the thieves run the same getaway every time, in roughly the same order. Here's where Binance's money is on it.

1. 1

   Grab it minutes

   Empty the exchange's hot wallets, its tills, on as many blockchains as possible before anyone can react.

   Done. Ten blockchains in about half an hour from 20:05 UTC on 29 October, and top-ups until just before midnight.

2. 2

   Ditch what can be frozen the first hour

   Digital dollars like Tether's USDT can be frozen by the company that issued them. So thieves swap them for coins nobody can freeze, at almost any price.

   Done. About $786 million of digital dollars became Ether and Tron in the first hour, at a loss of about $119 million in bad prices. $2.85 billion was frozen anyway.

3. 3

   Split it up the first days

   Spread the money across many fresh wallets, so it's harder to follow and no single freeze can catch it all.

   Done. The bitcoin went into 19 wallets in the same block it was stolen in, the Ether into a few big stashes, the Tron into five new wallets, and on 2 November the XRP into six new ones.

4. 4

   Cross the bridges days to weeks the money is here

   Swap it into bitcoin or other coins on services that don't ask who you are, like THORChain. Each hop to another blockchain makes the trail harder to follow.

   Under way. About $242 million of the Tron money crossed through Relay, THORChain, Chainflip and Symbiosis by 1 November, and since then more than half the Solana has been swapped into bitcoin through Relay. THORChain paused most of its trading on 31 October over an unrelated bug, which slowed it down.

5. 5

   Wash it weeks

   Run it through mixers, services built to blend it with other people's money until nobody can tell whose is whose.

   Not yet. No stolen money has been seen going into a mixer.

6. 6

   Lie low weeks to months

   Stop moving and wait for the world's attention, and the trackers' alerts, to move on.

   Partly: the bitcoin and the Ether stashes have sat still since the night of the theft. The XRP and Solana sat still too, until 1 and 2 November. The bags at the top of this page show what is still waiting.

7. 7

   Cash out months

   Sell it through brokers who pay cash or bank transfers, often through Chinese-language laundering networks, a little at a time.

   Not yet.

What they did last time

The same hackers, or hackers the trackers tie to the same country, have run this getaway before. Each line is one of their big thefts: the stops it reached, and how many days after the theft. The scale stretches the first days, because that's when most of it happens.

What happens next, probably

Nobody knows. But if this goes the way their last big thefts went, this is the order to expect.

1. This week, days 3 to 10

   The Ether crosses to bitcoin

   On the fast track, the big swap to bitcoin started on day 3 or 4: Bybit, KelpDAO and Bitget all used THORChain, which has refused to block stolen money before. Bybit's thieves had moved all of their Ether by day 10.

   Watch for: the Ether stashes on this page emptying, with THORChain in the list of moves.

2. Within two weeks

   Mixers, and the first sales

   Bybit's first bitcoin went into mixers on day 10, and the first sales through brokers and no-questions exchanges came on day 11. Since 2024, every big case with data ran through Chinese-language laundering networks.

   Watch for: a bag of bitcoin here emptying into a crowd of new wallets at once.

3. Or a long wait

   They go quiet

   The other pattern is patience. WazirX's thieves sat still for 45 days and Harmony's for about 192 before they washed the money. Binance's bitcoin and Ether have sat still since the theft; the bags at the top of this page show whether they still are.

   Watch for: nothing at all. Silence is a move too.

4. Months

   Cash, slowly

   Bybit's money was all cashed out about seven months after the theft, an 11-country sanctions monitoring team said, much of it sold on peer-to-peer markets about $7,000 at a time. Late freezes are rare: most past thefts lost 6% or less to them.

   Watch for: news of seizures. This page can only see the first wallets.