Binance Hackers Have Turned $124M of Stolen Crypto Into Bitcoin as $3.1B Sits Unmoved, Elliptic Says

Published November 7, 2026, 8:15 AM PKT. Based on the Elliptic report "How North Korea is laundering the $6.4 billion stolen from Binance", updated November 6, 2026, at 08:45 UTC (primary source), with reporting by Decrypt on November 6, 2026 (secondary reporting).

About $3.11 billion of the $6.43 billion stolen from Binance on October 29 remains in addresses linked to the theft, mostly in Ethereum ($ETH) and Bitcoin ($BTC), and those funds are "very likely" still held by North Korea, blockchain analytics firm Elliptic said in a report updated Friday, November 6, 2026, at 08:45 UTC. A further $2.85 billion, or 44 percent of the haul, has been frozen or seized, mostly stablecoins that issuers such as Tether and Circle froze within an hour of the theft. Only a negligible amount has likely been cashed out into spendable money so far, Elliptic said.

$3.11 billion still sits in the thieves' wallets

The unmoved bulk of the haul has barely shifted in eight days. The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft, was split into 19 addresses on the day of the hack and has not moved since, Elliptic said. The nine largest Ethereum ($ETH) addresses, which hold 89 percent of the attacker's ETH, have not moved since October 30. The funds that have not moved are very likely still held by North Korea, Elliptic said, while funds being laundered may already be with Chinese money laundering networks that North Korea has used before. The FBI attributed the October 29 theft to North Korean hackers it calls TraderTraitor on October 31, and North Korea has denied involvement. The theft ran from 20:05 to 23:56 UTC on October 29, and the stolen funds sat on 11 different blockchains.

$124 million has already become Bitcoin

What is moving is being converted into Bitcoin ($BTC). By 08:45 UTC on November 6, about 1,650 BTC, worth roughly $124 million, sat in new Bitcoin addresses, converted from other stolen assets, Elliptic said. That is almost twice the figure a day earlier, and most of the overnight increase came from XRP ($XRP) swapped through THORChain, a cross-chain swap service. All of the stolen Solana ($SOL), about $87 million at current prices, has been swapped, bridged or mixed, and much of it has ended up as Bitcoin. About $50 million of XRP has been swapped so far, mostly through THORChain into Bitcoin, and about $226 million of XRP remains to be moved. Only small parts of the ETH, $3 million of $1.33 billion, and NEAR ($NEAR), $0.9 million of $45 million, have moved. The laundering has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions, roughly one new wallet every 30 seconds and one transaction every 10 seconds. Elliptic called the operation "highly complex and clearly automated" but said the evidence points to conventional automation, not AI agents making decisions.

The Tron pipeline: 684 million TRX through one wallet

Most of the laundering so far, about $220 million in Tron ($TRX), has run through Tron. At 02:19 UTC on October 30, a single distribution wallet began sending the attacker's 684.6 million TRX out in small amounts to hundreds of new addresses, and the funds spread across about 7,700 addresses, Elliptic said. The wallet made 1,113 transfers over 51 hours, speeding up from under 12 million TRX an hour for most of October 30 to as much as 37 million an hour on October 31, and kept running through both nights in Pyongyang. Almost all of the TRX was bridged out and paid out as ETH on Ethereum ($ETH). By around 05:00 UTC on November 1, activity on Tron had largely stopped, and only about $1 million in TRX now remains there. The attacker also routed some TRX through a JustLend lending vault, depositing from one address and withdrawing to 16 new ones with no direct transfer linking them, and swapped some TRX for USDD ($USDD), a stablecoin that markets itself as freeze-free.

Stablecoins froze fast, but $786 million slipped through

Of the $6.43 billion taken, $3.46 billion, or 54 percent, was in stablecoins such as USDT ($USDT) and USDC ($USDC), and the attacker's first priority was to swap them for assets that cannot be frozen, such as ETH and TRX. Tether froze the stolen USDT 37 minutes after it arrived, but before the freeze the attacker managed to swap 434 million USDT for ETH on decentralized exchanges such as Uniswap, Elliptic said. It also borrowed 19,762 ETH on the lending protocol Aave against a further 59.9 million USDT. On Tron, it swapped 234 million USDT for TRX on SunSwap before Tether froze the rest, and Circle froze all 823 million stolen USDC before any of it had been swapped. In total, about $786 million in stablecoins was converted before the freezes landed, and $2.85 billion was frozen or seized. Elliptic noted the 44 percent freeze rate compares with around 3 percent frozen after the $1.5 billion Bybit hack in February 2025, a freeze rate about 15 times higher. Part of the attacker's Aave loan was liquidated on November 4 after a rise in the price of ETH, when a liquidator repaid about 9,900 ETH of the debt and took about 24 million USDT of the collateral.

Mixers, coinjoins and the Privacy Cash pool

The attacker has also begun mixing the funds to break the visible link between the coins going in and those coming out. Since November 1, about 33 BTC, worth around $2.5 million, has been put through Wasabi-style coinjoins, which combine many users' Bitcoin in a single transaction, Elliptic said. Since November 3, about $1.1 million in ETH and SOL has been deposited into the Privacy Cash privacy pool, which paused deposits for about a day after citing the Binance hack, while withdrawals stayed open and deposits to its Solana pool resumed the next afternoon. Elliptic said no further deposits into Privacy Cash from addresses linked to the theft have been seen since it resumed. On November 2, the attacker moved all 233 million stolen XRP to six new addresses, where it stayed until November 5, when two of the six addresses began sending it on to dozens of new accounts for swapping, mostly through THORChain into Bitcoin. THORChain itself halted swaps on most of its blockchains at 11:34 UTC on October 31 after a technical fault, and resumed late on November 3. By the evening of November 4, about 12,200 ETH, worth $29 million, most of it from the sale of stolen SOL, had gone through THORChain into Bitcoin.

What happens next: the slow road to cash

Elliptic expects the attacker to swap the ETH for Bitcoin and then try to cash it out through over-the-counter brokers and exchanges over a period of months, as happened after the Bybit hack, when North Korea laundered all 499,000 stolen ETH within 10 days but took months to cash out. The main Bitcoin and ETH holdings have still not moved, and the firm said the first step is already visible in the other stolen assets, with about $124 million converted into Bitcoin so far. Binance, meanwhile, has continued to restore services. On Friday, the exchange said users could now verify that their balances are backed at least 1:1 using the zero-knowledge proof for its latest proof-of-reserves snapshot, Decrypt reported, and that it aims to reopen withdrawals for all tokens on restored networks by the end of next week. The attack itself was a multi-stage campaign, Elliptic said: in June, one engineer installed a tampered copy of an AI coding tool, which exposed the wallet team to the attackers, and in September, attackers posing as recruiters put another engineer through fake job interviews and had him download a malicious assignment onto his work computer, before reaching Binance's wallet signing service on October 29.

Sources

• Elliptic, How North Korea is laundering the $6.4 billion stolen from Binance, updated November 6, 2026, 08:45 UTC (primary source: $3.11 billion remains in theft-linked addresses, mostly ETH and BTC, very likely still held by North Korea, $2.85 billion frozen or seized, $124 million converted into Bitcoin, about 1,650 BTC, 20,000 wallets on 16 blockchains, at least 36 services, at least 65,000 transactions, 18,270 BTC in 19 addresses unmoved, nine largest ETH addresses hold 89 percent of attacker ETH, unmoved since October 30, $220 million in TRX through Tron, 684.6 million TRX from a single distribution wallet, 1,113 transfers over 51 hours, $87 million in SOL fully swapped, bridged or mixed, $50 million of XRP swapped and $226 million remaining, 33 BTC through Wasabi-style coinjoins, $1.1 million in ETH and SOL into Privacy Cash, $786 million in stablecoins converted before freezes, Tether froze USDT 37 minutes after arrival, 434 million USDT swapped for ETH, 19,762 ETH borrowed on Aave against 59.9 million USDT, Circle froze all 823 million USDC, Aave loan partial liquidation November 4, 9,900 ETH repaid and 24 million USDT collateral taken, THORChain halt and resumption, June tampered AI coding tool and September fake job interviews, theft 20:05 to 23:56 UTC on October 29)
• Decrypt, $3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic, November 6, 2026 (secondary reporting: $3.11 billion remains, $2.85 billion frozen or seized, 44 percent of the haul, around 3 percent frozen after the Bybit hack, $50 million of XRP swapped through THORChain with $226 million still to move, 1,650 BTC converted, laundering highly complex and clearly automated, no AI agent evidence, FBI attribution to TraderTraitor on October 31, North Korea denial, Binance zero-knowledge proof verification and withdrawal reopening aims)
• Cryptopolitan, Binance hackers swap $124M of stolen altcoins into Bitcoin as withdrawals reopen, November 6, 2026 (secondary reporting: $124 million swapped into about 1,650 BTC, $50 million in XRP moved with $226 million still in hacker wallets, $2.85 billion frozen and $3.11 billion still held, 20,000 wallets and 65,000 transactions across 16 blockchains, Binance aims to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week)

This article is news reporting and is not investment advice.