The 18,270 BTC stolen in the October 29, 2026, Binance hack had not moved since being split across 19 addresses on the day of the theft, according to an Elliptic report updated November 6. The Bitcoin was worth about $1.5 billion when stolen.
Across all stolen assets, Elliptic said roughly $3.11 billion remained in addresses linked to the attack, mostly in Bitcoin and ETH. The firm assessed that those funds were “very likely” still held by North Korea.
The FBI attributed the $6.43 billion theft to North Korean hackers it calls TraderTraitor. North Korea denied involvement.
Bitcoin holdings and conversions
Although the originally stolen Bitcoin remained stationary, the attacker was converting other assets into BTC. In a November 6 update, Elliptic put those conversions at approximately 1,650 BTC, worth about $124 million—almost twice the figure a day earlier. Much of the conversion activity used cross-chain service THORChain.
The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had not moved since October 30. Elliptic expected the attacker to swap ETH for Bitcoin and then cash out through over-the-counter brokers and exchanges over several months. That was the firm’s forecast, not a confirmed sequence of future transactions.
For comparison, Elliptic said North Korea had laundered all 499,000 ETH stolen in the February 2025 Bybit hack within 10 days, but took months to cash out.
Frozen funds and automated transfers
About $2.85 billion, or 44% of the Binance haul, had been frozen or seized. Most consisted of stablecoins that issuers including Tether and Circle froze within an hour of the theft. Elliptic compared that with roughly 3% frozen after the $1.5 billion Bybit hack.
The laundering operation had used more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. Elliptic described the process as “highly complex and clearly automated,” with roughly one new wallet created every 30 seconds.
The speed prompted speculation about AI agents, but Elliptic said it had seen no evidence of an AI agent making decisions. Its assessment pointed instead to conventional automation.
How other stolen assets were moving
Most laundering activity to that point involved about $220 million in TRX. A single distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, including overnight in Pyongyang. Almost all of it was bridged to Ethereum.
All stolen Solana, valued at about $87 million at prices cited in the report, had been swapped, bridged or mixed. The attacker had also begun moving stolen XRP, converting about $50 million, mostly through THORChain into Bitcoin, with approximately $226 million remaining.
Some funds passed through privacy services: about 33 BTC, worth roughly $2.5 million, went through Wasabi-style coinjoins. About $1.1 million in ETH and SOL entered the Privacy Cash pool, which paused deposits for approximately a day.
Binance’s recovery timetable
On November 6, Binance said users could verify that their balances were backed at least 1:1 using the zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week; that remained a target rather than a completed restoration.
Original source: Decrypt, published November 6, 2026, at 22:04:18 UTC+08:00. This article preserves the original reporting timeframe.