Community Trust ScoreVerified
Blockchain analytics firm Elliptic reported on Friday that approximately $3.11 billion of the $6.43 billion stolen from Binance remains in addresses linked to the theft, according to Crypto — Decrypt. The funds are primarily held in Ethereum and Bitcoin, and Elliptic stated they are “very likely” still controlled by North Korea.
Earlier reporting: Coinbase states 99% of assets in cold storage after Binance breach.
Earlier reporting: Bitcoin Reclaims $80,000 as Democrats Take Congress.
Frozen Funds and Attribution
A further $2.85 billion, representing 44% of the total stolen amount, has been frozen or seized. Elliptic noted that these frozen assets are mostly stablecoins that issuers such as Tether and Circle froze within an hour of the theft. This response contrasts sharply with the aftermath of the $1.5 billion Bybit hack in February 2025, where only about 3% of the stolen funds were frozen, according to Elliptic.
The FBI has attributed the October 29 theft to North Korean hackers it identifies as TraderTraitor. North Korea has denied involvement in the incident.
Laundering Mechanics and Speed
Elliptic described the laundering activity as “highly complex and clearly automated.” The operation has utilized more than 20,000 wallets across 16 blockchains, engaging at least 36 services and executing at least 65,000 transactions. The pace of activity includes the creation of a new wallet roughly every 30 seconds.
Most of the laundering to date, approximately $220 million in TRX, has moved through the Tron network. A single distribution wallet sent 684.6 million TRX to hundreds of new addresses over a 51-hour period, with activity continuing through the night in Pyongyang. Almost all of this TRX was bridged to Ethereum.
Other stolen assets have also been processed. All stolen Solana, valued at about $87 million at current prices, has been swapped, bridged, or mixed. Regarding XRP, approximately $50 million has been swapped, mostly through the cross-chain service THORChain into Bitcoin, while about $226 million remains to be moved. In total, about $124 million has been converted into Bitcoin, resulting in approximately 1,650 BTC.
Specific portions of the funds have been obscured using mixing techniques. About 33 BTC, worth around $2.5 million, passed through Wasabi-style coinjoins. Additionally, approximately $1.1 million in ETH and SOL was deposited into the Privacy Cash pool, which paused deposits for about a day following the influx.
Future Expectations and Exchange Status
The speed of the transactions has led to speculation about the use of AI agents. Elliptic countered that the evidence points to conventional automation, stating, “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions.”
Elliptic expects the attacker to swap the remaining ETH for Bitcoin and then cash out through over-the-counter brokers and exchanges over a period of months. The firm noted that after the Bybit hack, North Korea laundered all 499,000 stolen ETH within 10 days but took months to complete the cash-out process.
Binance has continued to restore services following the hack. On Friday, the exchange announced that users can verify their balances are backed at least 1:1 using a zero-knowledge proof for its latest proof-of-reserves snapshot. Binance aims to reopen withdrawals for all tokens on restored networks by the end of next week.
Source: Decrypt
