About $3.11 billion of the $6.43 billion stolen from Binance on October 29, 2026, remained in theft-linked addresses, according to an Elliptic report updated on November 6. The blockchain analytics firm said those assets, mostly ETH and Bitcoin, were “very likely” still held by North Korea.
Another $2.85 billion, or 44% of the stolen funds, had been frozen or seized. Most were stablecoins that issuers including Tether and Circle froze within an hour of the theft. By comparison, Elliptic said roughly 3% was frozen after the $1.5 billion Bybit hack in February 2025.
The FBI attributed the Binance theft to North Korean hackers it calls TraderTraitor. North Korea denied involvement.
Large holdings were still stationary
As of the report, the 18,270 BTC stolen from Binance—worth about $1.5 billion at the time of the theft—had not moved since being divided among 19 addresses on the day of the attack. The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had been inactive since October 30.
Those stationary holdings contrasted with an extensive laundering operation elsewhere. Elliptic described the activity as “highly complex and clearly automated,” involving more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. That amounted to roughly one new wallet every 30 seconds.
How the moving funds were being converted
Most laundering to that point involved about $220 million in TRX moving through Tron. A single distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including overnight in Pyongyang. Almost all of it was bridged to Ethereum.
Elliptic also reported that:
- All stolen Solana, worth about $87 million at then-current prices, had been swapped, bridged or mixed.
- About $50 million in stolen XRP had been converted, mostly through THORChain into Bitcoin, with roughly $226 million remaining.
- Bitcoin accumulated through conversions from other stolen assets totaled about 1,650 BTC, worth $124 million—almost twice the figure a day earlier. Much of the conversion activity used THORChain.
- Around 33 BTC, worth approximately $2.5 million, had passed through Wasabi-style coinjoins.
- About $1.1 million in ETH and SOL had entered the Privacy Cash pool, which paused deposits for about a day.
The pace prompted speculation about AI agents, but Elliptic said its evidence pointed to conventional automation: “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions.”
Conversion and cashing out are different stages
Elliptic expected the attacker to swap the remaining ETH for Bitcoin and then cash out through over-the-counter brokers and exchanges over several months. That was an expectation, not a completed outcome.
The firm cited Bybit as a historical comparison: North Korea laundered all 499,000 ETH stolen in that attack within 10 days, but took months to cash out. The Binance case differed in a significant respect—the reported frozen or seized share was 44%, compared with roughly 3% after Bybit.
Binance’s service-restoration timeline
On November 6, Binance said users could verify that their balances were backed at least 1:1 using the zero-knowledge proof accompanying its latest proof-of-reserves snapshot. The exchange also said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week. That was its stated target at the time, not confirmation that withdrawals had fully resumed.
Original publication: November 6, 2026, at 22:04:18 UTC+08:00. Source: Decrypt’s original article.
