Historical report published November 6, 2026, at 22:04:18 UTC+8.
Funds remaining and assets frozen
As of Elliptic’s November 6, 2026 update, about $3.11 billion of the $6.43 billion stolen from Binance on October 29 remained in addresses linked to the theft. The blockchain analytics firm said those assets, mostly ETH and Bitcoin, were “very likely” still held by North Korea.
A further $2.85 billion, or 44% of the stolen funds, had been frozen or seized. Most were stablecoins frozen by issuers including Tether and Circle within an hour of the theft. Elliptic compared that with roughly 3% frozen following the $1.5 billion Bybit hack in February 2025.
The FBI attributed the Binance theft to North Korean hackers it calls TraderTraitor. North Korea denied involvement.
Large Bitcoin and Ethereum holdings remained stationary
Elliptic’s tracking showed a distinction between assets still sitting in theft-linked wallets and funds already moving through laundering routes:
- Bitcoin: The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft, was divided among 19 addresses on October 29 and had not moved since.
- Ethereum: The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had not moved since October 30.
- Bitcoin converted from other assets: This had reached about 1,650 BTC, valued at $124 million—almost twice the amount recorded a day earlier.
These were observations of fund locations and movements, not a forecast of market prices.
Active laundering spanned multiple chains
Elliptic described the laundering as “highly complex and clearly automated.” It had involved more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions, with roughly one new wallet created every 30 seconds.
Most laundering activity reported so far involved about $220 million in TRX on Tron. One distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including overnight in Pyongyang. Almost all of those funds were bridged to Ethereum.
All the stolen Solana, worth about $87 million at prices cited in the report, had been swapped, bridged or mixed. Laundering of the stolen XRP had also begun: about $50 million had been converted, mostly through THORChain into Bitcoin, while roughly $226 million remained to be moved.
Across assets, about $124 million had been converted into Bitcoin, much of it through THORChain.
Some funds also entered mixing services. About 33 BTC, worth approximately $2.5 million, passed through Wasabi-style coinjoins. Around $1.1 million in ETH and SOL was deposited into the Privacy Cash pool, which paused deposits for about a day.
Automation evidence, not proof of AI agents
The pace prompted speculation that AI agents were moving the assets. Elliptic said its evidence instead pointed to conventional automation:
“The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions.”
The firm expected the attacker to exchange ETH for Bitcoin and then cash out through OTC brokers and exchanges over several months. That was Elliptic’s assessment, not an observed outcome. As a comparison, it said North Korea laundered all 499,000 ETH stolen in the Bybit hack within 10 days but took months to cash out.
Binance’s restoration update
On November 6, Binance said users could verify that their balances were backed at least 1:1 using a zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange also said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week.