Elliptic says $3.1 billion from Binance hack remains unlaundered

What happened

Elliptic, a blockchain analytics firm, said in an updated report on Friday that roughly half of the $6.43 billion taken from Binance on October 29 had not yet been laundered. About $3.11 billion remains in addresses connected to the theft, mainly in ether and bitcoin, and Elliptic said those funds are very likely still held by North Korea. Decrypt and Bitcoin.com News both reported the findings.

Another $2.85 billion, or 44% of the total, has been frozen or seized, Elliptic said. Most of that amount consists of stablecoins that issuers including Tether and Circle blocked within an hour of the breach. The firm estimated that only a negligible share of the stolen assets has been converted into spendable funds.

The attackers have begun laundering stolen XRP, according to the report. About 42 million XRP, worth roughly $50 million, moved from linked wallets starting Thursday afternoon, with most swapped into bitcoin through the cross-chain protocol THORChain. About 192 million XRP, valued at $226 million, remained to be moved. The amount converted into bitcoin reached about 1,650 BTC, worth $124 million, nearly double the level a day earlier.

Large parts of the haul have stayed put. The 18,270 BTC stolen from Binance was divided among 19 addresses on the day of the hack and has not moved since, the reports said. The nine largest ether addresses, which hold 89% of the attacker's ETH, have been inactive since October 30. Bitcoin.com News reported that only about $3 million of the roughly $1.33 billion in stolen ETH had passed through laundering channels.

Why it matters

The large unlaundered balance leaves a substantial share of the proceeds traceable, giving exchanges and investigators more opportunities to identify and potentially intercept funds before they are turned into cash. Elliptic's comparison with the earlier Bybit hack underscores how quickly stablecoin issuers acted this time: about 44% of the Binance haul has been frozen or seized, compared with around 3% after Bybit. Moving coins between wallets or swapping one asset for another does not by itself mean the hackers have successfully cashed out.

What the data shows

Elliptic's tracing shows a laundering operation that has grown rapidly. The firm has identified more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions, amounting to roughly one new wallet every 30 seconds. It described the laundering as highly complex and clearly automated. While the speed has prompted speculation about AI agents, Elliptic said the evidence points to conventional automation rather than an AI agent making decisions.

A major route has run through Tron. About $220 million in TRX moved through the network, with a single distribution wallet sending 684.6 million TRX to hundreds of new addresses over 51 hours, including through the night in Pyongyang, Elliptic said. Almost all of those funds were bridged to Ethereum. The firm also found about 33 BTC, worth around $2.5 million, processed through Wasabi-style coinjoins, and about $1.1 million in ETH and SOL deposited into the Privacy Cash pool, which paused deposits for about a day.

Background

The FBI has attributed the October 29 theft to North Korean hackers it calls TraderTraitor. North Korea has denied involvement. Binance disclosed on Tuesday that the breach followed a months-long campaign involving malicious developer software, fraudulent job interviews and compromised internal artificial intelligence tools, according to Bitcoin.com News. The attackers ultimately reached wallet-signing infrastructure and carried out unauthorized transactions across multiple blockchains. The case follows the February 2025 Bybit hack, previously the largest crypto heist at about $1.5 billion. Elliptic said North Korean attackers laundered all 499,000 stolen ETH from Bybit within 10 days but took months to cash out. Binance has continued restoring services; on Friday it said users could verify balances at least 1:1 through a zero-knowledge proof in its latest proof-of-reserves snapshot, and it aims to reopen withdrawals for all tokens on restored networks by the end of next week.

What to watch

Elliptic expects the attacker to convert remaining ether into bitcoin and then try to cash out through over-the-counter brokers and exchanges over a period of months. The immediate signals to watch include any movement from the dormant bitcoin and large ether wallets, further conversion of the remaining XRP, and whether more stolen assets are frozen or seized. Binance's restoration of withdrawals and proof-of-reserves checks will also be relevant to users affected by the breach.

Questions readers ask