Stolen Binance Funds Are Moving: How Merchants Can Avoid Accepting Tainted Crypto

03/11/2026

On 29 October 2026, attackers drained roughly $6.3 billion in digital assets from Binance hot wallets across multiple blockchains — the largest crypto theft on record. Binance says it has covered user losses and resumed withdrawals on 1 November. But for businesses that accept crypto, the story is not over: a large part of the stolen money is still moving on-chain, and some of it may try to reach merchants as "normal" payments.

This article explains what changed in the last few days and what merchants should do to avoid receiving tainted funds.

What's new since the hack

FBI attribution and address list. On 31 October the FBI attributed the theft to North Korea's "TraderTraitor" activity, published Ethereum, Bitcoin and Solana addresses linked to the attack, and urged crypto businesses to block transactions involving them.
Tether freeze statement. Tether froze roughly $971 million in stolen USDT. Together with Circle, issuers blocked an estimated $1.8 billion in stablecoins in the days after the attack.
Unfrozen funds were swapped. On-chain analysis by Bitquery, reported by Bitcoin.com News, estimates that about $729 million in stolen USDT moved before the freezes took effect and was mostly swapped into ETH and TRX. This figure has not been confirmed by other analytics firms.
Exchange status. Binance resumed withdrawals in phases from 1 November, starting with ETH, USDT and USDC, and says it set aside more than $6 billion to replace affected assets.
Attribution is disputed. On 3 November North Korea publicly rejected the US allegations. Blockchain analytics firms including Elliptic and Chainalysis continue to trace the stolen funds.

In short: stablecoins that issuers could freeze are blocked, but value that was converted into ETH and TRX is now harder to stop — and those are exactly the assets many merchants accept every day.

Why this matters for merchants

Stolen funds are usually laundered through many hops: swaps, bridges, mixers, and finally payments or exchange deposits. A merchant who receives coins with a direct or close link to sanctioned or FBI-flagged addresses can face:

Frozen balances. Exchanges, OTC desks and banks screen deposits. Funds traced to the Binance hack may be held when you try to convert or withdraw them.
Compliance questions. In the EU, crypto-asset service providers under MiCA and the Travel Rule must apply AML controls; your providers will ask about the source of suspicious incoming funds.
Irreversible losses. If tainted coins are frozen downstream, the goods or services have already been delivered, and the loss sits with the merchant.

High-ticket and high-volume businesses (gaming, ticketing, luxury retail, digital goods, payouts platforms) are most exposed, because one large payment can be enough to trigger a review.

What to do now: a merchant checklist

Screen every incoming payment. Use AML/KYT checks that score the source address and its transaction history before you credit the customer or ship goods.
Hold large payments for review. Set a threshold above which incoming payments are checked manually before fulfilment.
Update block lists. Addresses published by the FBI on 31 October are already covered by PassimPay’s AML screening. If you use another provider, ask how quickly newly flagged addresses reach its lists.
Watch ETH and TRX inflows closely. These are the main assets the unfrozen USDT was swapped into; unusual new customers paying large amounts in ETH or TRX deserve extra attention.
Move funds off hot wallets. Use auto-withdrawal to your own wallet or auto-conversion to stablecoins, so balances do not sit idle on any single platform.
Keep records. Store transaction hashes, customer data and screening results — you will need them if a counterparty asks about the source of funds.

How PassimPay helps

PassimPay is a crypto payment gateway for businesses that combines payment acceptance with built-in compliance tools. On passimpay.io merchants get:

Free AML screening of every incoming transaction, covering the addresses published by the FBI on 31 October. If a payment is flagged as high-risk, crediting is temporarily held and the merchant is notified, so you can decide what to do before releasing goods or crediting the customer.
74+ coins across 18+ networks, including USDT, ETH and TRX, with fees from 0.5%.
Auto-conversion to USDT/USDC and auto-withdrawal to reduce exposure to volatility and platform risk.
KYC/KYB onboarding for merchants — see why crypto payment services need your data.

If you want to understand the wider impact of the attack on liquidity and provider concentration, read our first analysis: Binance $6.3B hack: what it means for businesses accepting crypto.

FAQ

Is it safe to accept crypto payments after the Binance hack? The networks themselves are not the risk. The risk is receiving coins linked to the stolen funds. Screening every incoming payment, and holding flagged ones before fulfilment, reduces that risk substantially, although no screening is absolute.

How can I check if a crypto payment is linked to the Binance hack? Use an AML/KYT tool or a payment gateway with built-in screening. It compares the sender's address and its transaction history against flagged addresses, including those published by the FBI on 31 October 2026.

Did Tether freeze the stolen USDT? Tether froze roughly $971 million in stolen USDT, and together with Circle issuers blocked an estimated $1.8 billion. About $729 million moved before the freezes and was mostly swapped into ETH and TRX, according to on-chain analysis by Bitquery.

What happens if I receive tainted crypto? Exchanges or banks may freeze the funds when you try to convert or withdraw them, and you may be asked to explain their origin. Keep records and contact your payment provider immediately.

Sources