World Events
Elliptic Says $3.1 Billion of Binance Loot Is Still Unlaundered as North Korea Denies FBI Attribution
About 44% of the $6.43 billion stolen has been frozen, while hackers have converted roughly $124 million into bitcoin, the analytics firm says.
By Emmanuel Cruz ·
Blockchain analytics firm Elliptic says about $3.11 billion of the crypto stolen from Binance on October 29 has not yet been laundered, even as the thieves move other funds through thousands of wallets and Pyongyang rejects U.S. claims that it was behind the theft [1][2].
According to Decrypt's account of Elliptic's Friday update, attackers took $6.43 billion in the hack. Of that, $2.85 billion, or 44%, has been frozen or seized, mostly stablecoins that Tether and Circle froze within an hour of the theft. After the $1.5 billion Bybit hack in February 2025, only about 3% was frozen [2]. Elliptic says the remaining $3.11 billion, mostly ether and bitcoin, sits in addresses linked to the attack and is very likely still controlled by North Korea [2]. The 18,270 bitcoin taken from Binance was split across 19 addresses on the day of the hack and has not moved, and the nine largest Ethereum addresses, holding 89% of the attacker's ether, have been still since October 30, Decrypt reported [2].
The laundering that has happened is large and fast. Elliptic counts more than 20,000 wallets across 16 blockchains and about 65,000 transactions [1][2]. Roughly $124 million of stolen altcoins has been swapped into bitcoin, much of it through THORChain, and about $50 million of stolen XRP has been converted with about $226 million still to move [1][2]. The Block noted that Elliptic expects only a negligible amount to have been cashed out so far, and that about $470 million is unaccounted for, a gap the firm's report did not fully explain [1].
Elliptic expects the attackers to turn remaining ether into bitcoin in small batches and then cash out through over-the-counter brokers and exchanges over months. After the Bybit theft, North Korea laundered all 499,000 stolen ether within 10 days but took months to cash out, Decrypt reported [2]. The firm also rejected speculation that artificial intelligence agents are making laundering decisions, saying the activity is automated but shows no sign of AI decision-making [1].
The geopolitical dispute is unresolved. The FBI said on Saturday, October 31, that North Korean hackers it calls TraderTraitor were responsible, confirming earlier attributions by TRM Labs and Chainalysis [3]. Kim Yo Jong, the sister of leader Kim Jong Un, answered through state media, calling the finding a "grave political provocation against the DPRK" and suggesting Washington could be behind the theft. She pointed to a U.S. plan to hold confiscated crypto in a strategic reserve and said whoever ends up holding the funds could reveal the culprit, Decrypt reported [3]. North Korea has denied earlier hacking accusations [3].
Binance has been working to restore normal operations. It says it has replenished about 98% of the stolen assets from its own funds and is buying the remainder, mostly less liquid tokens [4]. Net withdrawals since reopening reached $4.72 billion earlier this week, which Binance called a relatively limited share of roughly $157 billion in assets, Decrypt reported [3]. On Friday the exchange said it aims to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week, along with all tokens on networks that are already restored [1].
For markets, the main questions are timing and scale. Conversion of stolen tokens into bitcoin and any eventual sale could add supply, though Elliptic's assessment is that cash-out will be gradual [2].
What to watch next: whether the dormant bitcoin and ether addresses start to move, Binance's withdrawal reopenings next week, updated Elliptic tallies, and any further evidence offered in the attribution dispute.
Sources:
[1] The Block, "Elliptic says Binance hackers swap stolen tokens for $124M in bitcoin, exchange plans more withdrawal reopenings", November 6, 2026. https://theblock.co/news/markets/2026-11-06-binance-hackers-swap-stolen-tokens-124-million-bitcoin-exchange-plans-withdrawal-reopenings-435930
[2] Decrypt, "$3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic", November 6, 2026. https://decrypt.co/382711/3-1b-in-stolen-binance-crypto-has-yet-to-be-laundered-elliptic
[3] Decrypt, "North Korea Denies $6.3B Binance Hack, Calls FBI Finding a 'Political Provocation'", November 3, 2026. https://decrypt.co/382394/north-korea-denies-6-3b-binance-hack-calls-fbi-finding-a-political-provocation
[4] Decrypt, "Binance Cuts Off SignalPlus API Keys Over 'Potential Security Issue' at Trading Platform", November 5, 2026. https://decrypt.co/382599/binance-cuts-off-signalplus-api-keys-over-potential-security-issue-at-trading-platform
This article was produced with AI assistance. It is for informational purposes only and is not financial advice. StockVolt and its authors may hold positions in securities mentioned.