Originally published by Decrypt on November 6, 2026, at 22:04:18 UTC+8.
About $3.11 billion of the $6.43 billion stolen from Binance on October 29 remained in addresses linked to the theft, according to an Elliptic report updated on November 6. The blockchain analytics firm said those funds, mostly ETH and Bitcoin, were “very likely” still held by North Korea.
Another $2.85 billion—44% of the stolen total—had been frozen or seized. Most of that was in stablecoins that issuers including Tether and Circle froze within an hour of the theft. Elliptic compared that with roughly 3% frozen following the $1.5 billion Bybit hack in February 2025.
The FBI attributed the Binance theft to North Korean hackers it calls TraderTraitor. North Korea denied involvement.
Large holdings remained still as laundering spread across networks
The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft, was divided among 19 addresses on October 29 and had not moved since. The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had not moved since October 30.
Elsewhere, Elliptic described the laundering as “highly complex and clearly automated.” It involved more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions—roughly one new wallet every 30 seconds.
Those figures measure activity associated with the theft, not growth in legitimate users or adoption. The reported automation also makes wallet and transaction counts particularly unsuitable as proxies for individual participants.
How the stolen assets were being moved
Most laundering up to that point involved about $220 million in TRX moving through Tron. A single distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including overnight in Pyongyang. Almost all of it was bridged to Ethereum.
Other movements reported by Elliptic included:
- Solana: All stolen SOL, worth about $87 million at prices cited in the report, had been swapped, bridged or mixed.
- XRP: About $50 million had been converted, mostly through THORChain into Bitcoin, with about $226 million remaining to be moved.
- Bitcoin conversions: Approximately 1,650 BTC, worth about $124 million, had been obtained by converting other stolen assets—almost twice the amount reported a day earlier. Much of the conversion used THORChain.
- Mixing: About 33 BTC, worth roughly $2.5 million, had passed through Wasabi-style coinjoins. Another $1.1 million in ETH and SOL had been deposited into the Privacy Cash pool, which paused deposits for about a day.
The speed prompted speculation that AI agents were directing the transfers, but Elliptic said it had evidence only of conventional automation.
“The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions,” the firm said.
Cash-out expectations and Binance’s recovery plans
Elliptic expected the attacker to exchange the ETH for Bitcoin and then cash out through over-the-counter brokers and exchanges over several months. That was a forecast, not a completed outcome. As a comparison, the firm said North Korea laundered all 499,000 ETH stolen in the Bybit hack within 10 days, but took months to cash out.
Binance was also restoring services. On November 6, the exchange said users could verify that their balances were backed at least 1:1 using the zero-knowledge proof for its latest proof-of-reserves snapshot. It said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week; the report did not establish that the reopening had been completed.
