Elementus analyzed suspicious CoinBene blockchain flows after the exchange announced maintenance and denied that user funds were at risk. The firm observed $105 million in ETH and tokens moving from CoinBene's hot wallet to three addresses, followed by eight hours of hot-wallet inactivity. Funds were then routed through intermediary sweeping addresses and sold or deposited at exchanges including Etherdelta, Binance, Huobi and Bittrex. Elementus said the rapid withdrawals, inactivity, and movement to exchanges were consistent with exchange-hack behavior, while noting the data was independently verifiable on-chain.