$3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic

The FBI has attributed the October 29 theft to North Korean hackers it calls TraderTraitor, though North Korea has denied involvement. About $2.85 billion, or 44% of the haul, has been frozen or seized, mostly stablecoins that issuers such as Tether and Circle froze within an hour of the theft.

Complex Laundering Operation

The laundering has been "highly complex and clearly automated," Elliptic said, using more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. The 18,270 BTC stolen, worth about $1.5 billion at the time, has been split into 19 addresses and hasn't moved since the hack.

Movement of Stolen Funds

Most of the laundering so far, about $220 million in TRX, has run through Tron, where a single distribution wallet sent 684.6 million TRX to hundreds of new addresses. All stolen Solana, about $87 million, has been swapped, bridged or mixed. The attacker has started laundering XRP, with about $50 million converted so far and $226 million remaining.

In total, about $124 million has been converted into Bitcoin, much through THORChain. Some funds have been mixed through Wasami-style coinjoins and Privacy Cash pool.

Expected Cash Out Strategy

Elliptic expects the attacker to swap ETH for Bitcoin and then cash out through over-the-counter brokers and exchanges over months, similar to what happened after the 2025 Bybit hack. After that hack, North Korea laundered all 499,000 stolen ETH within 10 days but took months to cash out.

Binance Recovery Efforts

Binance has continued restoring services. On Friday, the exchange said users could verify their balances are backed at least 1:1 using zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange aims to reopen withdrawals for all tokens on restored networks by the end of next week.