Binance hack: tracing finds the funds. Coordination makes a freeze possible.
On 29 October, Binance reported a security incident affecting approximately $6.3 billion in cryptoassets. Its preliminary investigation pointed to a possibly compromised employee laptop that allowed an attacker to access an internal service and submit unauthorised withdrawals. By its 30 October update, Binance said it had worked with blockchain partners to freeze roughly $3 billion in affected assets. These were early figures, and frozen assets should not be treated as money already recovered or returned.
The response illustrates the point we made on LinkedIn on 30 October: tracing establishes where funds moved, but acting on those findings requires evidence to reach the right crypto service, token issuer or law enforcement agency while intervention is still possible. Across borders, that also means understanding who can act, what evidence they need and how to reach them urgently.
For law firms, this is the practical role Recoveris can play alongside counsel: tracing the assets, preparing evidence and supporting coordination with the organisations able to act. In the final week of October, Roman Bieda spent four days at an INTERPOL cybercrime event in Asia, where Tether was also represented. These working discussions help build the international relationships needed when a European client’s stolen assets move beyond Europe. Recoveris connects its European base with investigators, law enforcement and industry counterparts across borders, so technical findings can reach the people able to assess and act on them. A freeze preserves an opportunity; returning assets still requires the appropriate legal and operational steps.
The same response should be accessible to individual victims and smaller organisations through clear reporting channels, evidence requirements and legal safeguards. Our published post calls for timely assistance without dependence on privileged access to industry stakeholders.
Read the incident report · Read our LinkedIn perspective
Contact us about investigation and response support for a client matter
CoinDCX’s October incident raises a question for any business withdrawing old cryptocurrency wallets from use: what happens when customers keep sending money to them? This month, we examine the records that reveal assets left at risk, the evidence needed when stolen funds move between blockchain networks or through services that obscure their trail, and the distinction between a settlement and money returned to victims.
CoinDCX: the account was credited, but the funds stayed at risk
In its 25 October statement, cryptocurrency exchange CoinDCX reported a loss of 15.99 million USDT from wallets it had withdrawn from use after an earlier security breach. USDT is a digital token designed to track the US dollar. Customers had continued sending deposits to the old wallet addresses, which identify where cryptocurrency can be received. CoinDCX said its automated process for moving those deposits into its current wallets had failed, leaving funds to accumulate in the old ones.
The exchange described two separate steps: recording a deposit in the customer’s account and transferring the actual assets to the wallets it was now using to hold customer funds. The account record could be updated even when the transfer failed. CoinDCX says it absorbed the loss; that statement does not establish that the stolen assets were recovered.
For lawyers reviewing the incident, the distinction identifies two sets of evidence to request: the exchange’s customer-account records and the records showing where the assets actually moved. Comparing them can help establish when the discrepancy arose, what alerts were generated and how the business responded.
Read CoinDCX’s account of the incident
Four questions for a review of how customer assets are held
- Which old wallet addresses still receive deposits, and what assets and blockchain networks are involved?
- For each deposit recorded in a customer’s account, is there a corresponding transfer to the wallets currently used to hold the funds? Which transfers are missing, and for how long?
- Who is notified when a transfer fails, who has authority to act, and what records show how the issue was resolved?
- Have the customer-account records, blockchain transaction records and internal system logs been preserved so the sequence of events can be reconstructed?
Start with one old address that still receives deposits and follow its latest payment. A customer’s account balance alone cannot show whether the underlying assets reached the intended wallet.
Three lessons from the incident desk
Initia: distinguish newly created tokens from assets actually lost
Bitquery’s reconstruction of the 23 October Initia incident separates two figures: approximately $7.48 million in the stated value of newly created tokens that lacked the required backing, and approximately $2.73 million in assets actually taken from reserves. The assets were released through blockchain “bridges”, services that enable assets to move between different blockchain networks. These figures measure different things and should not be treated as interchangeable estimates of loss. The underlying technical cause remained unresolved in that reconstruction.
For the case file, document each release from reserves and any later exchange into another asset. Record what asset was held, on which network and at what time. Those details help investigators and legal advisers assess whether a proposed restriction could reach the proceeds; the transaction trail alone does not establish the legal basis for that action.
Read Bitquery’s transaction reconstruction
Drift: preserve evidence before the transaction trail becomes harder to follow
Arkham reported that the attacker behind the Drift theft transferred approximately $122.3 million worth of ether, the cryptocurrency used on Ethereum, into Tornado Cash across 520 transfers on 20–21 October. Tornado Cash is a “mixer”: a service designed to make it harder to connect a cryptocurrency deposit with a later withdrawal. These movements involved proceeds of the April theft, so they are an update on the movement of stolen funds, not a new loss to add to October’s total.
Preserve the transaction references, amounts, timestamps and evidence connecting the depositing addresses to the theft. Those records can establish that the funds entered the mixer. They do not, by themselves, prove which later withdrawals belong to the same person; that connection requires additional evidence.
Our earlier 1inch case study describes how patterns in withdrawals and later transfers between blockchain networks produced further investigative leads. Such analysis must be assessed against the evidence in each case. A lead identifying where funds may have gone is not proof that those funds have been recovered or returned.
Arkham’s Drift update · Read the Recoveris 1inch case study
NovaTech: distinguish a settlement from money returned to victims
On 22 October, the New York Attorney General announced settlements requiring four NovaTech and AWS Mining promoters to pay nearly $6 million for victims’ benefit. The announcement also described a request for further relief against the founders.
An obligation to pay, money collected and money distributed to victims are separate milestones. Record each with its supporting document and date, so a client update shows precisely what has been achieved and what remains outstanding. The announcement does not establish that victims had received payments under these settlements.
Read the New York Attorney General’s announcement
Selected incidents and developments from our completed reviews through 25 October. Each figure is presented on the basis used by its source; the figures should not be added together as a monthly loss total.
Industry watch
Crypto-funded cards bring identity questions to the checkout
An October investigation by The Economist, republished by Mint and discussed on our LinkedIn page, examined how crypto-funded cards can be used to purchase American AI services from places where access is restricted. The reporting describes gaps in customer verification among some providers, as crypto balances pass through card programmes and payment networks before reaching a merchant.
For compliance teams, the useful question is how to connect the payment with the person and funding behind it. Wallet activity, the card issuer’s customer records and merchant transactions each contribute part of that picture. Investigators need to preserve the links between them when assessing a particular payment.
Read The Economist’s investigation in Mint · Our perspective
CryptoBilis: a correction can change the direction of a case
The October wallet-drain investigation involving Ledger devices purchased through CryptoBilis brought device provenance into the case alongside transaction tracing. Bitquery’s reconstruction also contains an instructive correction: addresses initially described as an OTC-style group were identified as THORChain vaults, and a supposed Binance lead was withdrawn because the payments belonged to other users of the service.
That correction matters whenever funds pass through shared infrastructure. Preserve the evidence behind an attribution, record revisions and check whether an apparent onward payment belongs to the same customer. A case involving suspected device tampering also needs purchase and setup records, so investigators can assess each affected wallet against the wider cluster.
Read the reconstruction and dated corrections
Gazeta Wyborcza also asked Dominik Konopacki to comment on the hardware-wallet thefts. His contribution focused on the device’s route to the buyer, its setup and the handling of the recovery phrase. Our accompanying article considers how providers and advisers can prepare a response before a loss is reported, including preserving evidence and coordinating the parties able to act.
Dominik’s media contribution · Read our incident-response article
Practice note: preserve the decision as well as the data
An address attribution can change after a customer has been onboarded. If that decision is reviewed months later, the team needs to reconstruct what it knew at the time: the dated source data, the checks performed, the analyst’s reasoning and the uncertainty recorded.
Our October discussion ahead of the ACAMS Switzerland event raised this practical test: can a colleague explain the original decision using the case file alone? Keeping the evidence used at the time makes that review possible even when a provider’s current label has changed.
Recoveris this month
ZondaCrypto at AML Summit in Vilnius
Recoveris was invited to present the ZondaCrypto case at AML Summit 2026. Dominik Konopacki shared the investigation, while Patrick Prinz joined the discussion on MiCA and institutional digital-asset adoption. The case showed why independent analysis of fund movements matters when public statements and reported figures leave questions unanswered.
What happens when the incident does not follow the manual?
In a panel clip shared this month from Vienna Blockchain Week, Patrick Prinz discussed how AML controls and incident response need to adapt as traditional finance and digital assets converge. Clear ownership, practiced escalation and people who can explain their decisions are what make a framework usable during an incident. The discussion also considered AI’s role in handling alerts, with testing and human accountability built into its use.
Expanding our work in Africa
Recoveris is expanding its services into Africa. On 13 October, Sol Cinosi joined William Beck of Elliptic at the AI & Crypto Fraud and Asset Recovery Forum organised by ACFE South Africa and Primerio, with Nicolas Oxenham of Primerio Forensics moderating.
The discussion focused on tracing stolen digital assets and turning blockchain data into evidence for cases in South Africa and across borders. Exchange cooperation and access to records remain practical hurdles when investigators and lawyers move a case towards legal action.
Accountable AI in FinanceX
Daniel Schink’s FinanceX article examines how AI can help assemble a reviewable case while keeping consequential decisions with investigators. It sets out a practical standard: conclusions should remain connected to their evidence, and disagreements between sources should stay visible to the reviewer.
Cross-border recovery in Copenhagen
Sol Cinosi joined the “Crypto Recovery in Practice” panel at the ICC FraudNet International Conference in Copenhagen. The discussion addressed the coordination needed between investigators and legal practitioners when identifying assets leads to proceedings across jurisdictions.
Recovery scams at Invest Cuffs
At Invest Cuffs in Poznań, Dominik Konopacki discussed AI-enabled impersonation and the risk of victims being approached again by fraudulent recovery providers. The practical takeaway: verify a provider independently, preserve the communications and question demands for a supposed tax to release recovered funds.
Read the Invest Cuffs coverage
An October recap from INTERPOL’s Vienna forum
In our 5 October recap, Patrick Prinz and Dominik Konopacki shared their experience at the preceding week’s INTERPOL New Technologies Forum in Vienna. The event brought law enforcement, researchers and private-sector specialists together to discuss how emerging technologies affect investigations.
For the team, the value was in comparing practical approaches to cases that cross platforms and borders, and in discussing how technical findings can be communicated so other parties can act on them.
November calendar
If you’re attending any of these events, contact us to arrange a meeting with the Recoveris team.
- 3–5 November · Warsaw Finance Week
- 4 November · CoinDesk Institutional London Luncheon
- 6 November · NEDIK Crypto Workshop
- 9 November · PACT Forum: Banking in Turbulent Times
- 10–11 November · Bluechip Conference
- 16–17 November · Insights2040 Annual Meetings
- 17 November · Fedpol / MROS Crypto Symposium
- 17 November · Swiss-Asian Deep Tech Forum
- 18–20 November · Singapore FinTech Festival
- 24 November · Recoveris × ACAMS Switzerland Chapter
- 30 November–1 December · OffshoreAlert London
Between editions
## Read more from Recoveris Monthly
