$3.11B of Stolen Binance Crypto Still Unlaundered, Elliptic Says

About $3.11 billion of the $6.43 billion stolen from Binance on October 29 remains in addresses linked to the theft, blockchain analytics firm Elliptic said in a report updated on Friday. The funds, held mostly in ETH and Bitcoin, are "very likely" still controlled by North Korea, the firm said.

The figure marks a rare bright spot in an otherwise record-setting heist. A further $2.85 billion — 44% of the haul — has already been frozen or seized, mostly stablecoins that issuers including Tether and Circle blacklisted within an hour of the theft. For comparison, roughly 3% of the $1.5 billion stolen in the Bybit hack of February 2025 was frozen, according to Elliptic.

Who is behind it, and how fast is it moving?

The FBI has attributed the theft to North Korean hackers it tracks as TraderTraitor. North Korea has denied involvement.

The laundering operation so far has been "highly complex and clearly automated," Elliptic said. It spans:

• More than 20,000 wallets across 16 blockchains
• At least 36 services, including bridges, mixers and swap protocols
• At least 65,000 transactions — roughly one new wallet created every 30 seconds

That speed has fueled speculation that AI agents are moving the funds. Elliptic pushed back. "The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," the firm said.

Where is the money now?

The largest piles have barely moved. The 18,270 BTC stolen — about $1.5 billion at the time of the theft — was split into 19 addresses on the day of the hack and has not shifted since. The nine largest Ethereum addresses, which hold 89% of the attacker's ETH, have been static since October 30.

The activity is concentrated in the mid-sized holdings:

• Tron: roughly $220 million in TRX moved when a single distribution wallet sent 684.6 million TRX to hundreds of fresh addresses over 51 hours — including overnight in Pyongyang. Almost all of it was bridged to Ethereum.
• Solana: the entire stolen stack, about $87 million at current prices, has already been swapped, bridged or mixed.
• XRP: laundering has started, with about $50 million converted so far and $226 million still to move, Elliptic said in a Friday update on X.
• Bitcoin conversion: about 1,650 BTC ($124 million) has been converted from other stolen assets, nearly double the figure a day earlier, with much of the flow running through the cross-chain service THORChain.

Mixing has played a small but measurable role. About 33 BTC, worth around $2.5 million, has passed through Wasabi-style coinjoins, and roughly $1.1 million in ETH and SOL went into the Privacy Cash pool, which paused deposits for about a day afterward.

Despite the scale of the churn, Elliptic assesses that only a negligible amount has likely been cashed out.

What happens next?

Elliptic expects the attacker to follow the playbook from Bybit. The remaining ETH will likely be swapped into Bitcoin and cashed out through over-the-counter brokers and exchanges over a period of months. After the Bybit hack, North Korea laundered all 499,000 stolen ETH within 10 days but needed months to convert it into spendable funds.

The 44% freeze rate sets this incident apart structurally. Stablecoin issuers acting within the first hour, rather than post-hoc law enforcement, did most of the containment — a shift that changes the economics of large-scale exchange theft and puts fresh pressure on OTC desks to screen incoming Bitcoin over the coming months.

Binance recovery timeline

Binance, for its part, has kept restoring services. On Friday the exchange said users can now verify that their balances are backed at least 1:1 using the zero-knowledge proof attached to its latest proof-of-reserves snapshot. The company aims to reopen withdrawals for all tokens on restored networks by the end of next week.