Elliptic: $3.11B of the Binance heist still sits in attacker addresses

Blockchain-analytics firm Elliptic says about $3.11 billion of the $6.43 billion drained from Binance on October 29, 2026 is still sitting in addresses linked to the theft — mostly unmoved ETH and BTC. A further $2.85 billion (44%) has been frozen or seized, mostly stablecoins. The breakdown is in Elliptic's post "How North Korea is laundering the $6.4 billion stolen from Binance" (updated 08:45 UTC on Nov 6), with Decrypt carrying the summary.

What Elliptic reports

• 18,270 BTC (~$1.5B at the time of the theft) sits across 19 addresses and has not moved.
• The nine largest Ethereum addresses, holding 89% of the attacker's ETH, have been still since October 30. Only about $3M of the roughly $1.33B in ETH has moved.
• About $220M in TRX moved through Tron and was then mostly bridged to Ethereum.
• All stolen Solana (~$87M) has been swapped, bridged, or mixed.
• About $50M of XRP has been converted; roughly $226M in XRP remains, much of it routed through THORChain into BTC.
• Roughly $124M of the stolen stock has been converted to Bitcoin so far.
• Privacy tooling: about 33 BTC went through Wasabi-style coinjoins; about $1.1M in ETH and SOL went into the Privacy Cash pool.

Scale metrics: Elliptic puts the laundering activity so far at more than 20,000 wallets, 16 blockchains, at least 36 services, and at least 65,000 transactions. Elliptic's reading is that the operation is "highly complex and clearly automated" — conventional automation, not an AI agent — and that "very likely" the untouched funds are still held by North Korea.

Attribution

The FBI publicly attributed the theft to North Korea in an alert the bureau issued after the hack, naming the actor TraderTraitor; the state has denied involvement. Per Elliptic, the pattern of the laundering so far echoes the 2025 Bybit incident: route into Bitcoin via cross-chain services, then bleed the BTC out through OTC desks over months. Only a negligible share of the funds has likely been cashed out at this point.

Why the number matters

A $3.11B mark on November 6 — one week after a theft of this size — is unusually high for an attacker of this profile. Two reasons:

1. Chain-level choke points. North Korea's strongest 2023–2025 laundering channels (sanctioned mixers, Tron-centric high-volume stablecoin routes) are now actively defended. The $2.85B already frozen or seized is almost entirely stablecoin issuance that stopped moving when issuers hit the freeze.
2. Cross-chain throttling. THORChain, one of the mixer-adjacent bridges Elliptic repeatedly names, halted swaps on October 31 after a technical fault and only resumed on November 3 — cutting the attacker's primary ETH→BTC path for three days.

What to watch

1. BTC held through THORChain and similar bridges: whether the attacker accelerates conversion to Bitcoin before more rails are policed.
2. OTC desk activity on exchanges with lax KYC: the Bybit template saw months of slow drip through regional OTC counterparties.
3. Whether Elliptic, TRM Labs, or Chainalysis issue new actor-labelling on specific exchange deposit addresses — the first on-ramp hit would be the clearest signal the laundering phase has begun in earnest.
4. Any additional stablecoin freezes: of the $2.85B frozen, most was stablecoins; USDT, USDC, and others still have discretion on remaining tainted supply.
5. Follow-up from Binance on counterparty exposure — the exchange has not publicly confirmed the FBI attribution.

Context

The Binance drain is the largest on-chain theft on record, surpassing the 2022 Ronin bridge hack ($624M) and the February 2025 Bybit hack (~$1.5B). As at the one-week mark, the share of funds still held by the attacker — rather than frozen, seized, or swapped — remains a harder data point than the raw stolen total. Elliptic's November 6 figure is the most complete public estimate; it will move as laundering continues.