Around $3.11 billion of the $6.43 billion stolen from Binance on October 29 remains in addresses linked to the theft, according to blockchain analytics firm Elliptic. The remaining $2.85 billion, or 44 percent of the haul, has been frozen or seized.
In a report updated Friday, Elliptic detailed a laundering operation spanning 20,000+ wallets across 16 blockchains using 36+ services. The FBI attributed the theft to North Korean hackers designated TraderTraitor. North Korea has denied involvement.
Elliptic stated the laundering is “highly complex and clearly automated,” though the firm added: “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions.” The operation involved approximately 65,000+ transactions.
Stablecoin Freeze and Asset Movement
Tether and Circle froze stablecoins within an hour of the theft. The 18,270 BTC stolen, valued at $1.5 billion at the time of the hack, has not moved since being split into 19 addresses on October 29. The nine largest Ethereum addresses, holding 89 percent of the attacker’s ETH, have not moved since October 30.
Elliptic said the remaining stolen funds are “very likely” still held by North Korea. All stolen Solana, worth $87 million at current prices, has been swapped, bridged, or mixed. A total of 33 BTC went through Wasabi-style coinjoins, valued at $2.5 million, while $1.1 million in ETH and SOL were deposited into a Privacy Cash pool.
Tron Laundering Volume
The largest laundering flow occurred on Tron, with $220 million in TRX moved through a single distribution wallet that sent 684.6 million TRX to hundreds of new addresses over 51 hours. An additional $124 million in Bitcoin, representing 1,650 BTC, was converted from stolen assets. XRP swaps totaled $50 million so far, with $226 million in XRP remaining to move.
Elliptic expects ETH to be swapped for Bitcoin and cashed out through over-the-counter brokers over months, mirroring patterns from the Bybit hack. In that incident, North Korea laundered 499,000 ETH in 10 days but took months to cash out. Only 3 percent of the $1.5 billion Bybit hack was frozen after the theft.
Binance Recovery Steps
Binance announced users can verify balances are backed 1:1 using zero-knowledge proof verification. The exchange aims to reopen withdrawals for all tokens on restored networks by the end of next week.
