In this article5 sections
Roughly half of the $6.43 billion taken from Binance in October had still not been laundered as of Friday, when blockchain analytics firm Elliptic published an update on the flow of funds. About $3.11 billion sits in addresses tied to the theft, mostly in ether and bitcoin, and Elliptic said those holdings are very likely still in North Korean hands, Decrypt reported.
The attackers have begun routing the stolen XRP into bitcoin. Bitcoin Magazine reported that about 42 million XRP, worth roughly $50 million, had already been swapped, mostly through cross-chain service THORChain, leaving about 192 million XRP (around $226 million) unswapped. The FBI attributed the October 29 theft to North Korean hackers it calls TraderTraitor; Pyongyang has denied involvement.
Also read: Binance's $6.3B hack linked to North Korea's TraderTraitor
Key facts
- Elliptic put about $3.11 billion still in addresses linked to the Binance theft, versus $2.85 billion (44% of the haul) frozen or seized, chiefly stablecoins locked by issuers including Tether and Circle within an hour of the breach.
- The laundering trail covers more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions — about one new wallet every 30 seconds, per Elliptic.
- All of the stolen Solana, about $87 million at current prices, has been swapped, bridged or mixed, and about $220 million in TRX moved through Tron via a single distribution wallet that sent 684.6 million TRX over 51 hours.
- Bitcoin Magazine reported that five hot wallets sent 233.46 million XRP to an attacker address between 20:05 and 20:09 UTC on October 29, and that all of it shifted into six new addresses on November 2 before two of them began forwarding funds on November 5.
- Binance said users can now verify balances at least 1:1 through the zero-knowledge proof in its latest proof-of-reserves snapshot, and it aims to reopen withdrawals for all tokens on restored networks by the end of next week, per its post on withdrawal restoration.
The big pools have stayed put
The two largest stashes have not moved. Binance’s 18,270 BTC, worth about $1.5 billion at the time of the hack, was split across 19 addresses on the day of the theft and has sat untouched since, while the nine biggest Ethereum addresses holding 89% of the attacker’s ETH have not moved since October 30. Elliptic’s Friday update tracked the XRP conversion through its post on the laundering progress.
Elliptic said the converted bitcoin pile from other stolen assets reached about 1,650 BTC, roughly $124 million, nearly double the figure a day earlier, with most of the jump coming from the XRP route. Some funds have been mixed: about 33 BTC, around $2.5 million, passed through Wasabi-style coinjoins, and about $1.1 million in ETH and SOL went into the Privacy Cash pool before it paused deposits for about a day.
The two firms’ wallets do not quite line up on the size of the theft. Decrypt cited $6.43 billion, while Bitcoin Magazine put Binance’s own figure at $6.34 billion.
Automation, not AI, Elliptic says
The pace of the transfers has prompted speculation that AI agents are running the laundering. Elliptic rejected that, saying the activity is clearly automated but that nothing observed shows an AI agent making decisions. Bitcoin Magazine described the pattern as fixed timing, set amounts, blind retries and new tactics introduced hours apart.
Elliptic expects the attacker to keep converting ether into bitcoin before attempting to cash out through over-the-counter brokers and exchanges over months. It compared the case to the Bybit hack of February 2025, when roughly 3% of the $1.5 billion haul was frozen, against 44% this time. After Bybit, North Korea moved all 499,000 stolen ETH within 10 days but took months to cash out, the firm noted.
Why it matters
The gap between how much was frozen this time and how little was frozen after Bybit shows how much faster stablecoin issuers now react to a large breach. The remaining risk sits with bitcoin and ether, which cannot be frozen the way stablecoins can, so the speed at which bridges and exchanges block flagged addresses will decide whether the rest of the XRP follows the first $50 million into BTC.
What to watch
Elliptic and Bitcoin Magazine both point to the roughly 192 million XRP still unconverted as the next measurable step, along with any movement in the parked ether and bitcoin. Binance’s stated target of reopening withdrawals for all tokens on restored networks by the end of next week is the other deadline to track.
Reported by Decrypt.
Sources: Decrypt, Bitcoin Magazine