About $3.11 billion of the $6.43 billion stolen from Binance remained in addresses linked to the theft, blockchain analytics firm Elliptic said in a report updated on November 6, 2026. The assets, mostly ETH and Bitcoin, were “very likely” still held by North Korea, according to the firm.
A further $2.85 billion, or 44% of the stolen funds, had been frozen or seized. Most of that consisted of stablecoins frozen by issuers including Tether and Circle within an hour of the theft. Elliptic compared that with roughly 3% frozen after the $1.5 billion Bybit hack in February 2025.
The FBI attributed the October 29 Binance theft to North Korean hackers it calls TraderTraitor. North Korea denied involvement.
Large Bitcoin and Ethereum holdings remained unmoved
Elliptic said the laundering operation was “highly complex and clearly automated,” involving more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. That represented roughly one new wallet every 30 seconds.
Despite that activity, substantial holdings had not moved:
- The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft, was divided among 19 addresses on the day of the hack and remained there.
- The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had been inactive since October 30.
How other stolen assets were being moved
Most laundering activity up to the report involved about $220 million in TRX. On Tron, a single distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including overnight in Pyongyang. Almost all of it was subsequently bridged to Ethereum.
All of the stolen Solana assets, worth about $87 million at prices cited in the report, had been swapped, bridged or mixed. The attacker had also begun moving stolen XRP: about $50 million had been converted, mostly through THORChain into Bitcoin, while approximately $226 million remained.
Across the stolen assets, about 1,650 BTC—worth roughly $124 million—had been accumulated through conversions, much of it using THORChain. Elliptic said that Bitcoin total was almost twice the figure a day earlier.
Some funds had also passed through privacy services. Around 33 BTC, worth about $2.5 million, went through Wasabi-style coinjoins. Approximately $1.1 million in ETH and SOL was deposited into the Privacy Cash pool, which paused deposits for about a day.
Automation, not demonstrated AI decision-making
The pace of transfers prompted speculation about AI agents, but Elliptic said its evidence pointed to conventional automation.
“The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions,” the firm said.
Elliptic expected the attacker to convert ETH into Bitcoin and then cash out through over-the-counter brokers and exchanges over several months. That was an expectation, not a confirmed outcome. As a comparison, the firm said North Korea laundered all 499,000 ETH stolen in the Bybit hack within 10 days, but took months to cash out.
Binance’s service restoration
On November 6, Binance said users could verify that their balances were backed at least 1:1 using the zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange also said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week.
Original publication: November 6, 2026, at 22:04:18 UTC+8. This article reflects the reporting available at that time.
Source: Decrypt’s original report.