Booty that burns your fingers. Eight days after the theft of $6.43 billion from Binance, the exchange reopens its network-by-network withdrawals. With the thieves, nothing is unlocked. According to Elliptic, $3.11 billion is still waiting in addresses linked to the theft.
The key points of this article:
Around $3.11 billion from the Binance hack is waiting in addresses linked to the theft, according to Elliptic.
Tether and Circle froze the stolen stablecoins in less than an hour, out of 2.85 billion seized in total.
The laundering circuit mobilized more than 20,000 wallets on 16 blockchains, without any trace of an AI agent.
Elliptic is counting on a conversion to bitcoin, then discreet exits via brokers over several months.
A hoard that no one can spend anymore
The October 29 hack remains the largest theft in the history of cryptocurrencies. The FBI attributed the burglary to TraderTraitor, a hacker collective working for Pyongyang. The North Korean regime denies any involvement and speaks of “serious political provocation”.
Of the stolen sums, $2.85 billion have already been frozen or seized, a figure in the report updated on Friday November 6. Freezing, here, is taken literally: Tether and Circle, the issuers of the stolen stablecoins, can lock their tokens remotely.
In other words, the maneuver is equivalent to publishing the serial numbers of stolen tickets, which no one can accept without being detected. The operation took less than an hour on the night of October 29.
As a result, 44% of the loot was unusable almost immediately, a record for a crypto theft, while Bybit had only allowed 3% to be frozen. At this point, the thieves robbed the bank without being able to take out the notes.
A large part of the loot remains immobile, and the 18,270 stolen bitcoins were distributed among 19 addresses on the day of the hack, without moving since.
On Ethereum, the nine largest addresses of attackers concentrate 89% of the stolen ether. They have not issued a transaction since October 30.
Only a negligible amount appears to have been transformed into spendable money. The rest, $3.11 billion, would remain in Pyongyang's hands. A treasure that blockchain analysis companies monitor live.
Because Pyongyang is trying. Laundering has already involved more than 20,000 wallets and 65,000 transactions.
The attackers created a new wallet every 30 seconds, a factory rate.
Most of the work was done on Tron. A distribution wallet there sent $220 million worth of TRX to hundreds of new addresses, for 51 hours straight. The cast even filmed at night, Pyongyang time.
Almost everything was then bridged to Ethereum. All of the stolen SOL, approximately $87 million, went through exchanges, bridges or mixers.
XRP has just started moving. The attackers have converted about $50 million of that, mostly via THORChain, into bitcoin, and there are $226 million left to move.
In total, around $124 million of the loot has already taken the form of bitcoins.
The speed of the maneuver fueled a rumor, that of AI agents at the controls. Elliptic cuts short in its report:
“Laundering is clearly automated, but nothing we've seen shows an AI agent making decisions. »
Elliptical
The company knows what happens next by heart. After the Bybit hack, North Korea moved the stolen 499,000 ETH in ten days, then took months to cash it out.
Elliptic expects the same scenario, converting ether into bitcoin then selling everything to over-the-counter brokers, these desks which process large amounts outside the platforms.
The ecosystem, meanwhile, tries to save the savable. Polygon wants a hard fork to return 70 million POL stolen from Polymarket and Binance.
