Half the $6.43B Binance Haul Is Still Unlaundered, Elliptic Says
Elliptic says roughly half of the $6.43 billion stolen from Binance on October 29 remains unlaundered, with $3.11 billion still held by the attacker and $2.85 billion frozen or seized.
Just over a week after attackers drained roughly $6.43 billion from Binance on October 29, about half of it is still sitting unmoved or has been locked up, according to a report from blockchain analytics firm Elliptic updated Friday and relayed by Decrypt.
Elliptic puts $3.11 billion — mostly ETH and Bitcoin — in addresses linked to the theft, and says those funds are "very likely" still controlled by North Korea. A further $2.85 billion, 44% of the haul, has been frozen or seized, mostly stablecoins that issuers including Tether and Circle froze within an hour of the breach. Elliptic contrasts that with roughly 3% frozen after February 2025's $1.5 billion Bybit hack — a faster clampdown this time.
The movement so far is, in Elliptic's words, "highly complex and clearly automated": more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions — roughly one new wallet every 30 seconds. The firm says only a negligible amount has likely been cashed out. The 18,270 BTC taken (about $1.5 billion at the time) was split into 19 addresses on the day of the hack and hasn't moved since; the nine largest ETH addresses, holding 89% of the stolen ether, have sat still since October 30.
Where funds have moved: about $220 million in TRX ran through Tron — a single wallet pushed 684.6 million TRX to hundreds of addresses over 51 hours — then bridged mostly to Ethereum. All of the stolen Solana (about $87 million) has been swapped, bridged or mixed. The attacker has begun on the XRP, with about $50 million converted and $226 million still to go. Elliptic counts roughly $124 million (about 1,650 BTC) converted into Bitcoin, much of it via cross-chain service THORChain — nearly double the prior day's figure.
Key facts
- $6.43B stolen from Binance, October 29 (Elliptic, via Decrypt).
- $3.11B unlaundered, "very likely" still North Korean; $2.85B (44%) frozen or seized (Elliptic).
- 20,000+ wallets, 16 blockchains, 36+ services, 65,000+ transactions (Elliptic).
- 18,270 BTC and 89% of stolen ETH unmoved since the hack (Elliptic).
- FBI attributes the theft to a North Korean group it calls TraderTraitor; North Korea denies involvement (Decrypt).
The real-world read "Half recovered" needs caution. The $2.85 billion "frozen or seized" is mostly stablecoins issuers can freeze with a keystroke — not clawed-back Bitcoin or ETH, which remain firmly with the attacker and are the hard part. Elliptic knocks down the AI-agent speculation around the laundering speed: "nothing we have seen shows an AI agent making decisions" — conventional automation. And the frozen figure is an early snapshot; Elliptic expects the ETH to be swapped to Bitcoin and cashed out through OTC brokers over months, as happened after Bybit, when North Korea laundered all 499,000 stolen ETH within 10 days but took months to actually cash out. Elliptic sells compliance tooling, so its visibility into "frozen" funds is also a selling point worth noting.
Opinion, and whose Elliptic forecasts a months-long swap-to-Bitcoin-then-OTC cashout, drawing the Bybit parallel. The $3.11 billion figure and the "very likely North Korea" attribution are Elliptic's analysis; the TraderTraitor attribution is the FBI's; North Korea denies it.
Sources
- Decrypt (Tier 2, secondary), Nov 6, 2026 — Elliptic's updated report and X posts on balances, laundering routes, and the Bybit comparison; FBI attribution and Binance's recovery timeline. No marketing or sponsored content identified.
This is reporting, not financial advice.