Elliptic wrote in a Monday update on the Binance hacker’s laundering efforts

Last updated: November 2, 2026, 07:30 UTC. This is a rapidly evolving situation and we will keep this article updated. The stolen funds are moving fast and in complex ways, so the description here may not be complete.

The laundering is highly complex and clearly automated. In under four days it has used 12,000 wallets across 11 blockchains, roughly one new wallet every 25 seconds, and more than 40,000 transactions.

Around $3.24 billion remains in addresses linked to the theft, mostly as ETH and BTC. A negligible amount has likely been cashed out.

The funds that have not moved are very likely still held by North Korea. Those being laundered may already be with Chinese money laundering networks, which North Korea has used before.

Most of the laundering so far has run through Tron, where the funds were split across 7,700 addresses and bridged to Ethereum. Since November 1, ETH, SOL, NEAR and XRP have begun to move.

For the first time, some of the stolen funds have been mixed. Since November 1, 28 BTC ($2.2 million) has been put through Wasabi-style coinjoins.

Based on the Bybit case, we expect the attacker to swap the ETH for bitcoin and then try to cash it out through OTC brokers and exchanges.

On October 29, $6.43 billion in cryptoassets was stolen from Binance, one of the world's largest cryptocurrency exchanges. The stolen funds were on 11 different blockchains. Binance has said the attack began with a compromised engineer's laptop. Our earlier article covers the attack and the attribution in detail. The laundering that followed has been highly complex: 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days.

Here is how the stolen funds have been laundered so far, day by day. When we say “the attacker,” we mean whoever controls the wallets now holding the funds. The blockchain shows us those wallets, but not who is behind them.

October 29: a race against the freezes

The theft ran from 20:05 to 23:56 UTC on October 29. Of the $6.43 billion taken, $3.46 billion (54%) was in stablecoins such as USDT and USDC. The companies that issue these stablecoins, such as Tether and Circle, can freeze them. So the attacker's first priority was to swap the stablecoins for assets that cannot be frozen, such as ETH and TRX.

On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived. Before the freeze, the attacker managed to swap 434 million USDT for ETH on decentralized exchanges (DEXs) such as Uniswap. It also borrowed 19,762 ETH on the lending protocol Aave against a further 59.9 million USDT. On Tron, it swapped 234 million USDT for TRX on SunSwap before Tether froze the rest. Circle froze all 823 million stolen USDC before any of it had been swapped.

In total, $2.85 billion has been frozen or seized. Around $786 million of stablecoins was converted before the freezes landed.

In the same half hour, the 18,270 stolen BTC was split into 19 addresses. It has not moved since.

October 30: Tron becomes the main route

After the first hour, almost nothing moved on Tron for five hours. Then, at 02:19 UTC on October 30, a single distribution wallet began sending the attacker's 684.6 million TRX out in small amounts to hundreds of new addresses. From there, the funds spread across 7,700 addresses.

Within the two and a half hours, the attacker made its first transfers through six different cross-chain bridges, mostly with test-sized amounts. Bridges take an asset on one blockchain and pay out an asset on another. Almost all of the TRX was paid out as ETH on Ethereum. At least $147 million has been bridged out of Tron so far.

On Ethereum, the arriving ETH was forwarded to newly created addresses, which then stopped moving. Today, 68,700 ETH is spread across 850 of these smaller addresses, most holding between 10 and 100 ETH. The nine largest addresses, which hold 89% of the attacker's ETH, have not moved since October 30.

October 31: new routes, and faster

On October 31, the attacker added new laundering routes. From 03:36 UTC, some TRX was swapped for USDD, a stablecoin that markets itself as “freeze-free” , meaning no central party can freeze it. From 05:18 UTC, one address put 128 million TRX through a JustLend lending vault, depositing from one address and withdrawing to 16 new ones. No direct transfer links them.

The distribution wallet also sped up, from under 12 million TRX an hour for most of October 30 to as much as 37 million an hour on October 31. It kept running through both nights in Pyongyang. At the busiest point, at 08:00 UTC on October 31, the attacker's Tron wallets made around 1,300 transactions in an hour.

Late on October 31, the FBI attributed the theft to TraderTraitor and published the attacker's addresses.

November 1: Tron goes quiet, other chains start moving

Other chains then started to move. From 07:00 UTC, NEAR was moved to new accounts. From 08:19 UTC, some of the parked ETH began to move again, in lots of around 10 ETH. From 09:38 UTC, around half of the SOL was moved to a new address, and small amounts have since been peeled off. NEAR has not moved since.

That day also saw the first mixing of the stolen funds. From 05:55 UTC, bitcoin from the Tron funds began going into coinjoins using WabiSabi, the protocol used by Wasabi Wallet and similar wallets. Later in the day, some of the parked ETH was swapped for bitcoin, and most of that went the same way. By 06:02 UTC on November 2, 28 BTC ($2.2 million) had been put through 18 coinjoins. A coinjoin combines many users' bitcoin in a single transaction, which breaks the visible link between the coins going in and those coming out.

November 2: the XRP moves

Early on November 2, the XRP moved for the first time since the theft. Between 02:12 and 04:00 UTC, all 233 million XRP was sent to six new addresses, where it remains. On Solana, the attacker swapped some SOL for USDC and back again, and passed SOL through a lending vault in the same way as on Tron: deposited from one address and withdrawn to another.

Tactics to make funds tracing more difficult

The attacker has combined several standard techniques. None is new, but together they make the funds more challenging to track:

Splitting the funds across thousands of new addresses, so there are many more transactions to follow.

Moving between blockchains through at least seven bridges. The deposit and the payout are separate transactions on different chains.

Swapping between assets on DEXs, so the asset being followed keeps changing.

Hopping through a lending vault, so that no direct transfer links the sending and receiving addresses.

Mixing bitcoin through coinjoins, which combine many users' coins in one transaction and break the visible link between the coins going in and coming out.

Splitting also helps in other ways. Smaller amounts can be swapped or bridged without moving prices. They stand out less to exchanges that screen incoming funds. And they can be laundered in small batches, at a pace of the attacker's choosing.

Is the laundering automated?

The speed of the laundering has led to speculation that AI agents are moving the funds. The evidence points to conventional automation: fixed timing, set amounts, blind retries, and new tactics introduced in steps hours apart. There were also pauses that look like human working patterns. The scale alone points to software. On Tron, the stolen funds moved in 32,000 transactions, peaking at around 1,300 in a single hour, one every three seconds. Each dollar laundered on Tron was moved nine times. The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions.

Where the funds are now

Of the $6.43 billion stolen, $2.85 billion is frozen. Around $3.24 billion remains in addresses linked to the theft. Most of it has not yet been laundered: the bitcoin and the ETH in the nine largest addresses. These funds are very likely still held by North Korea. The funds already being laundered may not be. In cases, North Korea has handed stolen funds to Chinese money laundering networks, and on-chain data cannot show whether that has happened here. Around $16 million has been sent to addresses that also hold proceeds of the September 2026 Bitget exploit, which is also believed to be the work of TraderTraitor.

Has any of it been cashed out?

A negligible amount has likely been cashed out so far. Most of what has happened is conversion: the funds have changed asset, but remain on public blockchains in addresses linked to the theft. To turn them into money it can spend, the attacker needs a counterparty, such as a centralized exchange or an over-the-counter (OTC) broker. That is where the funds can be identified and stopped.

After the Bybit hack in February 2025, North Korea laundered all 499,000 stolen ETH within ten days , mostly by swapping it for bitcoin. Cashing out then took months. Elliptic found that the Bybit funds were ultimately converted to USDT on Tron and cashed out through suspected Chinese over-the-counter (OTC) trading services . These traders pay sellers off-chain, so the on-chain trail ends with them.

The Binance laundering is slower so far. ETH and BTC cannot be frozen, so there is no rush. The sums are more than twice those stolen from Bybit, and moving them quickly would mean large losses on swaps. And with the attacker's addresses published by the FBI, services are watching. We expect the ETH to be swapped for bitcoin in many small transactions, and then cashed out through OTC brokers over a period of months.

Further freezes will be harder. Freezing 44% of the stolen funds is already unusual. After the Bybit hack, around 3% was frozen . The best remaining chances are stablecoins caught briefly in transit, where Elliptic alerts have already led to freezes, and centralized services at the point of cash-out.

What this means for compliance teams

To be cashed out, the stolen funds will have to pass through centralized services. Elliptic traces them across bridges, DeFi protocols and new addresses, and updates its screening data as they move, so compliance teams do not need to follow each hop themselves. Elliptic customers can screen against more than 9,500 addresses linked to the theft, and our free blocklist is available to any business.

One caution: third parties are sending fake tokens from look-alike addresses to the attacker's addresses. These address-poisoning scams are not controlled by the attacker. We will continue to report on the laundering as the funds move.