|
Getting your Trinity Audio player ready...
|
- About $124M of stolen assets has been converted into 1,650 BTC, while roughly $3.11B remains in linked addresses and a negligible amount has been cashed out.
- Around $2.85B, or 44% of the haul, is frozen or seized, compared with about 3% in the Bybit hack.
- Elliptic expects BTC and ETH to be moved in small batches and cashed out over months, and sees automation rather than AI agents behind the laundering.
The hackers behind the roughly $6.4 billion Binance theft have started turning stolen assets into Bitcoin, but most of the money has not gone anywhere. In its November 6 update, blockchain analytics firm Elliptic said about 1,650 BTC, worth around $124 million, has been converted from other stolen tokens. That is nearly double the previous day’s figure, driven largely by XRP routed through THORChain. About $3.11 billion still sits in addresses tied to the theft, and Elliptic believes a negligible amount has been cashed out.
The Biggest Holdings Haven’t Moved
Bitcoin and Ether make up most of the dormant funds. All 18,270 stolen BTC was split across 19 addresses within about half an hour of the theft and had not moved as of the update. Of roughly $1.33 billion in stolen ETH, only about $3 million has moved. The nine largest addresses, which hold 89% of it, have been idle since October 30.
Other networks look different. About $220 million in TRX has run through laundering transactions, and all of the roughly $87 million in stolen SOL has been swapped, bridged or mixed. Around 42 million XRP ($50 million) has gone mostly into Bitcoin, while 192 million XRP ($226 million) remains parked.
Stablecoin Freezes Forced the Attackers’ Hand
The theft ran across 11 blockchains on October 29, and about $3.46 billion, or 54%, was held in stablecoins. Because issuers can freeze those tokens, the attackers rushed to swap into assets like ETH and TRX. Tether froze stolen USDT on Ethereum 37 minutes after it arrived, though about 434 million USDT had already been swapped. Circle froze all 823 million stolen USDC before any of it moved. Roughly $786 million in stablecoins was converted before the freezes took effect, and about $2.85 billion, or 44% of the haul, is now frozen or seized.
An Automated Laundering Machine
Elliptic counted more than 20,000 wallets, 16 blockchains, at least 36 services and over 65,000 transactions. That works out to roughly one new wallet every 30 seconds. The funds have passed through bridges, decentralized exchanges, lending vaults, CoinJoin mixing, Privacy Cash and THORChain.
Despite speculation, Elliptic says the pattern points to conventional automation, not AI agents making decisions. It also linked about $16 million to addresses holding proceeds from the September 2026 Bitget exploit.
Slower Than Bybit, But Months Remain
In the 2025 Bybit hack, attackers moved all 499,000 ETH within 10 days, and only about 3% was frozen. Here, with BTC and ETH beyond any issuer’s reach, the attackers face less urgency. Elliptic expects ETH to move into Bitcoin in smaller batches, followed by over-the-counter cash-outs over several months. Some funds may reach Chinese laundering networks, though on-chain data cannot confirm that. Remaining chances to freeze funds include stablecoins before conversion and centralized services at cash-out.
Attribution and Binance’s Response
The FBI blames North Korea’s TraderTraitor group, which Pyongyang denies. Binance says the attack began months earlier through a tampered developer tool and fake job interviews. Co-CEO Richard Teng said the exchange takes full responsibility, and reports say about 98% of the stolen tokens had been replenished by November 4.
What to Watch
Converting funds is not the same as cashing out, and Elliptic’s figures are on-chain estimates. The dormant ETH and BTC are the next signal.
FAQs
1. How much of the Binance hack money has actually been cashed out?
According to Elliptic’s November 6 update, a negligible amount has likely been cashed out so far. About $124 million has been converted into Bitcoin, roughly $3.11 billion remains in addresses linked to the theft, and about $2.85 billion (44%) has been frozen or seized. Converting funds into another cryptocurrency is not the same as turning them into cash, and Elliptic’s figures are on-chain estimates, not confirmed withdrawals.
2. Who is behind the Binance hack and how are the stolen funds being laundered?
The FBI attributed the October 29 theft to North Korea’s TraderTraitor group, which North Korea denies. Elliptic says the laundering involves more than 20,000 wallets across 16 blockchains, at least 36 services and over 65,000 transactions. The attackers have used bridges, decentralized exchanges, lending vaults, liquid-staking services, CoinJoin mixing, Privacy Cash and THORChain. Elliptic notes that on-chain data tracks wallet movements, not the individuals controlling every address.
3. Are AI agents running the Binance laundering operation?
Elliptic says no. Despite speculation about the speed and scale of the transfers, the firm points to conventional automation, citing fixed transaction timings, repeated amounts, blind retries, staged techniques introduced hours apart, and pauses consistent with human working patterns. In its words, nothing it has seen shows an AI agent making decisions.
Disclaimer: The information in this article is for general purposes only and does not constitute financial advice. The author’s views are personal and may not reflect the views of Chain Affairs. Before making any investment decisions, you should always conduct your own research. Chain Affairs is not responsible for any financial losses.
I’m your translator between the financial Old World and the new frontier of crypto. After a career demystifying economics and markets, I enjoy elucidating crypto – from investment risks to earth-shaking potential. Let’s explore!
