The $6.43 billion stolen from Binance on October 29 has been spread across about 12,000 wallets on 11 blockchains in under four days. That is roughly one new wallet every 25 seconds and more than 40,000 transactions, according to Elliptic’s tracking of the laundering. All figures here are from Elliptic’s page as updated at 07:30 UTC on November 2.
For holders, two numbers matter most. First, $2.85 billion, or 44% of the haul, has been frozen or seized. Elliptic calls that “already unusual”: after the Bybit hack, around 3% was frozen. Second, most of what remains has not been laundered yet. That includes 18,270 stolen BTC and 233 million XRP sitting in known addresses.
The theft itself ran from 20:05 to 23:56 UTC on October 29. Binance has said it began with a compromised engineer’s laptop. Late on October 31, according to Elliptic, the FBI attributed the theft to the North Korean group TraderTraitor and published the attacker’s addresses. Our earlier report on the frozen funds covered the first count of the freezes.
Stablecoin Freezes Caught Most of the Haul
Stablecoins made up $3.46 billion of the stolen $6.43 billion, or 54%. That is why so much could be stopped. Issuers can freeze their own tokens; nobody can freeze BTC or ETH.
The freezes were fast but not instant. On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived. In that window the attacker:
- swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap
- borrowed 19,762 ETH on the lending protocol Aave against a further 59.9 million USDT
On Tron, the attacker swapped 234 million USDT for TRX on SunSwap before Tether froze the rest. Circle did better: it froze all 823 million stolen USDC before any of it was swapped.
In total, around $786 million of stablecoins was converted before the freezes landed. That is less than a quarter of the stablecoin haul, but it is the part now hardest to recover.
The attacker has also adapted. From October 31, some TRX was swapped for USDD, a stablecoin that, in Elliptic’s words, “markets itself as ‘freeze-free’, meaning no central party can freeze it.”
Laundering on Tron Hit One Transaction Every Three Seconds
The pace on Tron shows how mechanical this operation is. The stolen funds moved in about 32,000 transactions there, peaking at around 1,300 in a single hour. Each dollar laundered on Tron was moved about nine times.
Elliptic is careful about what that proves. “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions,” it wrote.
Some of the money also crossed paths with an earlier theft. Around $16 million has gone to addresses that also hold proceeds of the September 2026 Bitget exploit, which is also believed to be TraderTraitor’s work.
18,270 BTC and 233 Million XRP Are Still Parked
Around $3.24 billion remains in addresses linked to the theft, and Elliptic says these funds are “very likely still held by North Korea.” Most of it has not been laundered yet.
- BTC: the 18,270 stolen BTC was split into 19 addresses and has not moved since.
- XRP: between 02:12 and 04:00 UTC on November 2, all 233 million XRP was sent to six new addresses, where it remains.
- ETH: the largest unlaundered ETH balances sit in the nine largest addresses.
Mixing has only just started. By 06:02 UTC on November 2, about 28 BTC ($2.2 million) had been put through 18 coinjoins, transactions that pool coins from many users to blur their trail. Elliptic estimates that “a negligible amount has likely been cashed out so far.”
Bybit Was Laundered in Ten Days. This Is Twice as Big
The last comparable case suggests a long tail. After the Bybit hack in February 2025, North Korea laundered all 499,000 stolen ETH within ten days, mostly by swapping it for bitcoin. Cashing out then took months.
The Binance sums are more than twice Bybit’s. Elliptic expects the same playbook: “We expect the ETH to be swapped for bitcoin in many small transactions, and then cashed out through OTC brokers over a period of months.” OTC brokers are over-the-counter desks that trade crypto for cash outside public exchanges.
That makes the parked BTC, XRP and ETH the thing to watch. The freezes have already set this case apart from Bybit. The next test is whether the roughly $3.24 billion that cannot be frozen starts moving, and how much of it gets traced before it reaches a broker.