Blockchain analytics firm Elliptic said about $3.11 billion of the $6.43 billion stolen from Binance remained in theft-linked addresses, mostly in ETH and Bitcoin, in a report updated on November 6, 2026. The firm assessed that those funds were “very likely” still held by North Korea.
The FBI attributed the October 29 theft to North Korean hackers it calls TraderTraitor. North Korea denied involvement. That attribution is separate from speculation that AI agents were directing the laundering—a claim Elliptic said its evidence did not support.
Historical report: the original article was published on November 6, 2026, at 22:04:18 UTC+8. Figures and service-restoration plans below reflect that reporting context.
Frozen funds and untouched wallets
According to Elliptic, another $2.85 billion, or 44% of the stolen haul, had been frozen or seized. Most of that consisted of stablecoins frozen by issuers including Tether and Circle within an hour of the theft. Elliptic contrasted that with roughly 3% frozen following the $1.5 billion Bybit hack in February 2025.
Large holdings had not moved:
- The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft, was split among 19 addresses on October 29 and had remained there.
- The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had been inactive since October 30.
A sprawling laundering operation—not evidence of AI
Elliptic described the laundering as “highly complex and clearly automated.” It had involved more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions—roughly one new wallet every 30 seconds.
That pace fueled speculation about AI agents. Elliptic drew a narrower conclusion: “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions.”
Automation was the firm’s finding; AI-directed decision-making remained unsupported.
Most laundering activity up to that point involved about $220 million in TRX on Tron. A single distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including overnight in Pyongyang. Almost all of it was bridged to Ethereum.
All the stolen Solana—valued at about $87 million at prices used in the report—had been swapped, bridged or mixed. The attacker had also begun moving the stolen XRP: about $50 million had been converted, mostly through THORChain into Bitcoin, with about $226 million remaining.
Across the stolen assets, roughly 1,650 BTC, valued at about $124 million, had been accumulated through conversions—almost twice the amount a day earlier. Much of that activity used cross-chain service THORChain.
Some funds also passed through mixing mechanisms. About 33 BTC, worth around $2.5 million, went through Wasabi-style coinjoins. Roughly $1.1 million in ETH and SOL was deposited into the Privacy Cash pool, which paused deposits for about a day.
Cashing out could take months
Elliptic expected the attacker to swap the ETH for Bitcoin and then cash out through over-the-counter brokers and exchanges over several months. That was a forecast, not a completed sequence of transactions.
For comparison, the firm said North Korea laundered all 499,000 ETH stolen in the Bybit hack within 10 days but took months to cash out.
Binance, meanwhile, said on November 6 that users could verify balances were backed at least 1:1 using the zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange also said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week. That reopening timetable was a stated target, not confirmation that withdrawals had resumed in full.