Approximately $3.11 billion of the $6.43 billion stolen from Binance on October 29 remains in addresses controlled by North Korean hackers, blockchain analytics firm Elliptic reported Friday. Stablecoin issuers Tether and Circle froze $2.85 billion (44% of the haul) within an hour, a recovery rate far exceeding the 3% frozen after February's $1.5 billion Bybit hack.
Key Takeaways
- $3.11B (48%) of $6.43B Binance hack remains unlaundered in North Korea-linked wallets per Elliptic Nov 6 report
- $2.85B (44%) frozen by Tether/Circle within one hour — vs 3% freeze rate in Bybit hack
- 18,270 BTC and 89% of stolen ETH static since Oct 30; $124M already converted to BTC via THORChain
- Laundering used 20,000+ wallets across 16 chains, 65,000+ txns; Elliptic sees automation but no AI agents
- Binance targets full withdrawal reopening by end of next week with ZK proof-of-reserves verification live
Executive Intelligence Brief
Laundering Mechanics and Current Fund Flows
The laundering operation has been "highly complex and clearly automated," according to Elliptic, utilizing more than 20,000 wallets across 16 blockchains, at least 36 services, and roughly 65,000 transactions — approximately one new wallet every 30 seconds. Despite the velocity, Elliptic found no evidence of AI-driven decision-making.
Most activity has centered on Tron, where a single distribution wallet sent 684.6 million TRX ($220 million) to hundreds of addresses over 51 hours, including overnight hours in Pyongyang. Nearly all TRX was bridged to Ethereum. The stolen Solana ($87 million) has been fully swapped, bridged, or mixed. XRP laundering has begun with $50 million converted via THORChain to Bitcoin and $226 million remaining. Total Bitcoin converted from other assets stands at roughly 1,650 BTC ($124 million), nearly double the prior day's figure.
Some funds have entered mixing services: approximately 33 BTC ($2.5 million) through Wasabi-style coinjoins and $1.1 million in ETH and SOL into the Privacy Cash pool, which paused deposits for roughly one day.
Asset Freeze Contrast and Industry Coordination
The 44% freeze rate represents a dramatic improvement over the Bybit hack, where only 3% was intercepted. Tether and Circle's ability to freeze stablecoins within an hour of the theft demonstrates the growing effectiveness of issuer-level controls. However, the core assets — 18,270 BTC (worth ~$1.5 billion at theft) split into 19 addresses on hack day, and nine Ethereum addresses holding 89% of the stolen ETH — have not moved since October 30, indicating the attackers are holding the most liquid assets for later conversion.
Attribution and Operational Patterns
The FBI has attributed the theft to TraderTraitor, a North Korean hacking group. Pyongyang has denied involvement. Elliptic notes the operational tempo — including overnight activity aligned with Pyongyang time — and the automated distribution patterns are consistent with previous North Korean operations. The firm expects the remaining ETH to be swapped for Bitcoin and cashed out through over-the-counter brokers over a period of months, mirroring the Bybit pattern where 499,000 ETH was laundered in 10 days but cash-out took months.
Exchange Recovery and Market Implications
Binance continues service restoration. On Friday, the exchange enabled users to verify balances are backed 1:1 via zero-knowledge proof for its latest proof-of-reserves snapshot, targeting full withdrawal reopening for all tokens on restored networks by end of next week. The sustained conversion of stolen altcoins to Bitcoin via THORChain and subsequent OTC liquidation creates a structural overhang for BTC markets, while the frozen stablecoins effectively remove $2.85 billion of liquidity from circulation.
