Mentioned in This Article
1. How much of the Binance hack has been laundered?
About half of the $6.43 billion taken in the Binance hack has not yet been laundered, according to blockchain analytics firm Elliptic, which updated its tracking report on Friday, November 6. The firm says roughly $3.11 billion remains in addresses linked to the October 29 theft, mostly in Ether (ETH) and Bitcoin (BTC), and is very likely still controlled by North Korea.
The finding matters because it separates the speed of the movement from its completeness. The attackers have created a vast web of wallets and transfers, yet the largest holdings have stayed put. Elliptic's reading is that the Binance hack laundering effort is far from finished, and that most of the value has not yet been converted into forms that can be cashed out.
Elliptic reports that the operation so far has used more than 20,000 wallets across 16 blockchains and at least 36 services, producing over 65,000 transactions. That works out to roughly one new wallet every 30 seconds, a pace the firm describes as highly complex and clearly automated.
2. How much was frozen or seized?
A further $2.85 billion, equal to 44% of the haul, has been frozen or seized. Most of that is stablecoins, which the issuers Tether and Circle froze within an hour of the theft.
Stablecoin issuers can freeze tokens at specific addresses, a power that the attackers cannot easily route around once the freeze is applied. The speed of the response is the notable part. Elliptic compares it with the $1.5 billion Bybit hack in February 2025, after which only about 3% of the stolen funds were frozen. By that measure, the share of funds immobilized after the Binance theft is dramatically larger.
The numbers fit together this way: $6.43 billion stolen in total, $2.85 billion frozen or seized, and $3.11 billion sitting in linked addresses that are still under the thieves' apparent control. The balance represents value that has moved but is not described as part of the unlaundered pool, which includes assets already swapped and scattered across chains.
3. Who is blamed for the theft?
The FBI attributed the October 29 theft to North Korean hackers, whom it calls TraderTraitor. North Korea has denied involvement.
Elliptic's own assessment of the unmoved funds points the same direction: it considers the linked addresses very likely to be controlled by North Korea. The comparison with Bybit is built on the same premise, since that 2025 theft was also attributed to North Korean actors, and the earlier episode provides the firm with a template for how the laundering may unfold.
Elliptic also noted that one distribution wallet on the Tron network sent funds to hundreds of new addresses over a 51-hour period, including overnight in Pyongyang. That timing detail is the sort of operational pattern analysts use to link on-chain behavior to a particular group, though the firm's central conclusion rests on the broader behavior of the funds.
4. Which assets have not moved at all?
The largest untouched positions are in Bitcoin and Ether. The 18,270 BTC taken from Binance, worth about $1.5 billion at the time of the theft, was divided across 19 addresses on the day of the hack and has not moved since.
On Ethereum, the nine largest addresses hold 89% of the attacker's ETH and have been inactive since October 30. Elliptic expects those holdings to be swapped into Bitcoin and cashed out through over-the-counter brokers and exchanges over a period of months.
The Bybit precedent shapes that forecast. After the 2025 theft, North Korea laundered all 499,000 stolen ETH within 10 days, but it took months to cash out. Applied here, that pattern suggests the next phase for the Binance haul would be rapid conversion of ETH into Bitcoin, followed by a slower process of turning those coins into cash, with the final stage drawn out over a long stretch.
5. How are the funds moving through other chains?
Elliptic describes a patchwork of routes. About $220 million in TRX has moved mainly through Tron. One distribution wallet sent 684.6 million TRX to hundreds of new addresses over 51 hours, and nearly all of that was bridged to Ethereum.
All of the stolen Solana (SOL), valued at about $87 million at current prices, has been swapped, bridged or mixed. XRP laundering has started: about $50 million worth, mostly through the THORChain protocol into Bitcoin, with about $226 million still to be moved. Across all assets, about $124 million has been converted into Bitcoin, or around 1,650 BTC, nearly double the amount a day earlier.
Mixing services form a smaller part of the picture. About 33 BTC, worth roughly $2.5 million, went through coinjoin-style mixers similar to Wasabi. About $1.1 million in ETH and SOL was deposited into the Privacy Cash pool, which paused deposits for around a day.
Bridges and swap protocols let an attacker change both the asset and the blockchain in a few steps, which makes tracing harder for investigators. Elliptic's count of 16 blockchains reflects how widely the attackers have spread their activity to exploit that feature.
6. Are AI agents moving the money?
Elliptic says the evidence does not support that idea. The pace and scale of the transfers have led to speculation that artificial intelligence agents are handling the laundering, but the firm's view is that the activity reflects conventional automation.
In its words, the laundering is clearly automated, but nothing it has seen shows an AI agent making decisions. The distinction is meaningful for investigators. Scripted automation follows fixed rules and tends to leave repeatable patterns, such as new wallets created at regular intervals, whereas an adaptive agent would be expected to change its behavior in response to what it encounters.
The observation of one new wallet roughly every 30 seconds is consistent with rule-based software that generates addresses on a schedule. Elliptic's assessment suggests that standard tracing techniques remain relevant to the case.
7. Why does the Bybit comparison matter?
The February 2025 Bybit theft of $1.5 billion is the closest reference point for the Binance case, and Elliptic leans on it repeatedly. In that episode, only about 3% of the stolen funds were frozen, while North Korea moved all 499,000 stolen ETH through its laundering pipeline within 10 days. Cashing out took months.
Against that backdrop, the current figures look different in one respect and similar in another. The freeze rate is far higher this time, at 44% of the total, thanks largely to Tether and Circle acting within an hour. The pace of laundering, however, resembles the earlier case: the attackers have already built an enormous network of wallets and begun converting assets, even though the biggest holdings have waited.
That pause is not unusual for a large theft. Moving billions of dollars in a single step would draw attention and invite freezes, so launderers typically break holdings into smaller pieces and shift them in stages. The nine Ethereum addresses holding 89% of the ETH, quiet since October 30, and the 19 Bitcoin addresses, quiet since the day of the hack, fit a strategy of holding the largest balances until the moment of conversion.
8. What the figures say about the scale of the operation
Elliptic's totals are worth reading together. Twenty thousand wallets, 16 blockchains, at least 36 services and more than 65,000 transactions describe an operation built to scatter value widely and quickly. Each additional chain and service adds another place where investigators must follow the trail and another chance for the attackers to break the link between a stolen coin and its destination.
Even so, a large share of the activity concerns relatively small amounts compared with the total. The $124 million converted to Bitcoin is about 1.9% of the $6.43 billion stolen, and the $50 million in XRP swaps is under 1% of the total. The Solana holdings of about $87 million and the roughly $220 million in TRX are similarly modest next to the unmoved $3.11 billion.
This gap between motion and progress is the central point of the update. A large count of wallets and transactions can create an impression of near-complete laundering, but the firm's figures show that most of the value is still waiting. Whether the attackers can convert it before further freezes or exchange blocks take effect is the open question the analytics community is now following.
9. What is Binance doing now?
Binance is restoring its services. The exchange says users can now verify, using a zero-knowledge proof attached to its latest proof-of-reserves snapshot, that customer balances are backed at least 1:1.
A zero-knowledge proof lets a party show that a statement is true without revealing the underlying data. In a proof-of-reserves setting, that means an exchange can demonstrate that its holdings cover customer balances without exposing individual account details, which is why such tools have become a common way for exchanges to rebuild trust after a security incident.
Binance also aims to reopen withdrawals for all tokens on restored networks by the end of next week. That target gives affected users a timeline, though it is tied to the networks that have already been brought back online.
10. What to watch next
Elliptic expects the unmoved Ether to be swapped into Bitcoin first, and the Bitcoin to be cashed out through over-the-counter brokers and exchanges over the following months. The most visible signals will be activity from the 19 addresses holding the 18,270 BTC and from the nine large Ethereum addresses that have been dormant since October 30.
The XRP balance of about $226 million is another marker: further swaps through THORChain would show whether the attackers are continuing to convert assets into Bitcoin at the pace seen so far. Meanwhile, the end of next week is the date Binance has given for reopening withdrawals on restored networks.
For exchanges and compliance teams, the practical takeaway from Elliptic's report is that roughly $3.11 billion remains traceable and uncashed. That gives freezing efforts and monitoring a window to work, while the Bybit experience suggests the window for ETH could be short and the window for final cash-outs much longer.