$3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic
Blockchain analytics firm reports that nearly half of the $6.43 billion stolen from Binance in October remains in attacker-linked wallets.
Quick Look
- Blockchain firm Elliptic reports $3.11 billion of the $6.43 billion stolen from Binance remains unlaundered.
- While $2.85 billion is frozen, the FBI attributes the October 29 hack to North Korean group TraderTraitor, which denies involvement.
AI-generated summary
Why It Matters
The FBI has attributed the October 29 theft of $6.43 billion from Binance to North Korean hackers known as TraderTraitor. North Korea has denied involvement in the incident.
Around half of the $6.43 billion stolen from Binance last month has yet to be laundered, blockchain analytics firm Elliptic said in a report updated on Friday.
About $3.11 billion remains in addresses linked to the theft, mostly in ETH and Bitcoin, and those funds are "very likely" still held by North Korea, Elliptic said. A further $2.85 billion, or 44% of the haul, has been frozen or seized, mostly stablecoins that issuers such as Tether and Circle froze within an hour of the theft. That compares with around 3% frozen after the $1.5 billion Bybit hack in February 2025, according to Elliptic.
The FBI has attributed the October 29 theft to North Korean hackers it calls TraderTraitor. North Korea has denied involvement.
The laundering so far has been "highly complex and clearly automated," Elliptic said. It has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions, roughly one new wallet every 30 seconds.
The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft, was split into 19 addresses on the day of the hack and has not moved since. The nine largest Ethereum addresses, holding 89% of the attacker's ETH, have not moved since October 30.
How the funds are moving
Most of the laundering so far, about $220 million in TRX, has run through Tron, where a single distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including through the night in Pyongyang. Almost all of it was bridged to Ethereum.
All of the stolen Solana, about $87 million at current prices, has been swapped, bridged or mixed, and the attacker has started laundering the stolen XRP, with about $50 million converted so far and $226 million remaining. In total, about $124 million has been converted into Bitcoin, much of it through cross-chain service THORChain.
Some funds have been mixed. About 33 BTC, worth around $2.5 million, has gone through Wasabi-style coinjoins, and about $1.1 million in ETH and SOL has been deposited into the Privacy Cash pool, which paused deposits for about a day.
The speed has fueled speculation that AI agents are moving the funds, but Elliptic said the evidence points to conventional automation. "The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," the firm said.
Elliptic expects the attacker to swap the ETH for Bitcoin and then cash out through OTC brokers and exchanges over a period of months. After the Bybit hack, North Korea laundered all 499,000 stolen ETH within 10 days but took months to cash out, the firm noted.
What to Watch
AI outlook — possibilities, not facts
Attacker will swap ETH for Bitcoin to cash out via OTC brokers.
Likely · Within months
Open Questions
- Will the remaining $3.11 billion be successfully recovered?
- What specific methods will be used to cash out the remaining funds?
