Eight Days After the Binance Breach, $124 Million Is Bitcoin

Eight days after $6.43 billion left Binance, the money is not leaving the blockchain. It is changing shape on it. By 08:45 UTC on 6 November, Elliptic counted about 1,650 BTC, then worth roughly $124 million, in newly created bitcoin addresses funded from the theft, almost twice the figure a day earlier. Against that, $2.85 billion has been frozen or seized, $3.11 billion still sits in addresses linked to the theft, and almost none of it has been turned into money anyone can spend.

Conversion is not laundering, and a wallet count is not a cash-out. Every swap, bridge and coinjoin in the chain stays visible on a public ledger; what the attackers have bought in eight days is distance from the moment of theft, not an exit. The exit needs a counterparty, whether an exchange, a broker or an over-the-counter desk, and that is where eight figures of tainted bitcoin become somebody’s compliance file. Elliptic writes that “the laundering is highly complex and clearly automated,” and the volume behind that sentence is large: more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. That works out to about one new wallet every 30 seconds and one transaction every 10 seconds, sustained for the week.

Washington has already named the actor. On 31 October the FBI attributed the theft to North Korea and published addresses for services to block. Elliptic’s report, written by co-founder Tom Robinson and last updated on 6 November, goes beyond attribution and tracks what the funds are doing. Its conclusion that the unmoved balance is “very likely still held by North Korea” is an assessment, and the report labels it as one.

How 44% of the haul was stopped before it moved

Of the $6.43 billion taken between 20:05 and 23:56 UTC on 29 October, $3.46 billion, or 54%, was in stablecoins such as USDT and USDC. Those tokens have issuers, and issuers can freeze balances. The attackers’ first job was to get out of them before anyone could. On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived; inside that window the attackers swapped 434 million USDT for ETH on decentralized exchanges and borrowed 19,762 ETH on Aave against a further 59.9 million USDT. On Tron they swapped 234 million USDT for TRX on SunSwap before Tether froze the rest. Circle froze all 823 million stolen USDC before a single token had been swapped.

By the end of the week $2.85 billion had been frozen or seized, and about $786 million in stablecoins had been converted before the freezes landed. That is 44.3% of the haul neutralised, against roughly 3% in the Bybit case 21 months earlier, a freeze rate about 15 times higher. For anyone asking how much of this money is gone, the answer is that it is neither gone nor back with the attackers: it is held, pending whatever comes next.

The $786 million that did escape is the other half of the lesson. About 23 cents of every stolen stablecoin dollar was swapped in the gap between arrival and intervention. The remaining float is gone, which is why the same trick cannot be repeated later in the laundering chain.

Why bitcoin, and why the exit is the hard part

Bitcoin offers what a frozen token does not: no issuer, no reversal, no compliance officer on the other end of a support ticket. Elliptic states the logic plainly. “ETH and BTC cannot be frozen, so there is no rush,” the report says, contrasting this case with Bybit, where all 499,000 stolen ETH moved within ten days.

Bitcoin also offers a bottleneck. To become money the coins have to pass through a counterparty, and counterparties screen. Elliptic says it has labelled nearly 18,000 addresses tied to the theft, screens against them in its products and published a free blocklist for other firms. The FBI published addresses too. The practical effect is that a large exchange deposit is now the most expensive way out, which pushes the cash-out toward over-the-counter desks. That is precisely where Elliptic expects it, based on Bybit, where the stolen funds were eventually converted to USDT on Tron and moved through suspected Chinese OTC services.

The conversion curve shows where the pressure is going. Nothing had been converted into bitcoin by 30 October. By the afternoon of 3 November about $17 million had arrived, a day later about $37 million, and by the morning of 6 November about $124 million. At bitcoin’s $75,832 on 7 November, the 1,650 BTC in those addresses is worth about $125 million.

Two caveats on the arithmetic. The converted bitcoin is a subset of the balance still held in linked addresses, not a separate bucket. And Elliptic’s figures are running estimates taken at slightly different points in a fast-moving case, so they do not reconcile exactly to the theft total. Data: Elliptic, CoinGecko.

Tron was the first conveyor belt, and it emptied

Tron carried the first and largest wave. From 02:19 UTC on 30 October a single distribution wallet began sending the attackers’ 684.6 million TRX out in small amounts, and the funds spread across about 7,700 addresses. The wallet made 1,113 transfers in 51 hours. At its busiest, around 08:00 UTC on 31 October, the Tron wallets made about 1,300 transactions in an hour, roughly one every three seconds. About $220 million in TRX has been laundered and about $1 million remains. At TRX’s $0.318 on 7 November, the 684.6 million tokens would be worth about $218 million, which puts the stolen Tron balance close to fully laundered.

The hops are the interesting part, because they are not transfers in any sense a naive screen would catch. On 31 October, one address put 128 million TRX through a JustLend lending vault, depositing from one address and withdrawing to 16 new ones, with no direct transfer linking sender and receiver. Some TRX was swapped for USDD, a stablecoin marketed as freeze-free. At least $147 million was bridged out of Tron, almost all of it paid out as ETH on Ethereum, some of it through THORChain until that service halted swaps on most chains at 11:34 UTC on 31 October after a technical fault. The attackers switched bridges, and the distribution wallet’s busiest hour came later the same day.

Elliptic counts about 32,000 transactions on Tron alone, with each dollar moved about nine times on its way out. That turnover ratio is the cleanest measure of what automation buys: not anonymity, but a paper trail thick enough that following it costs more than most compliance teams can afford.

Nine addresses hold 89% of the ether, and they have not moved

The ether is the part that has not been touched. About 68,300 ETH sits across roughly 830 addresses, most holding between 10 and 100 ETH, and nine addresses hold 89% of the attackers’ ETH. That is about 60,800 ETH, worth roughly $136 million at 7 November’s $2,237.71. None of those nine has moved since 30 October. The bitcoin that was never converted follows the same pattern: 18,270 BTC, split into 19 addresses in the same half hour as the theft, still sitting, worth about $1.39 billion at the current price.

This is the balance Elliptic describes as very likely still held by North Korea, and the qualifier carries weight. On-chain data shows which keys can move a coin. It does not show who holds those keys, whether a state custodian has them, or whether a broker has taken control without moving anything. Elliptic states the limit itself: past cases suggest North Korea hands funds to Chinese laundering networks, and on-chain data cannot show whether that has happened here.

The XRP leg is now the fastest-moving part

All 233 million stolen XRP was consolidated into six addresses between 02:12 and 04:00 UTC on 2 November, then left alone for three days. From the afternoon of 5 November it started moving. About 42 million XRP, roughly $50 million of it, was swapped mostly through THORChain into bitcoin by 08:45 UTC on 6 November, and about 192 million XRP remains. At XRP’s $1.18 on 7 November that residue is worth about $227 million, close to Elliptic’s own $226 million mark.

The XRP was routed through bridges rather than centralized venues, and that choice keeps the flow away from the screening a large exchange deposit would trigger. Solana is effectively done as a holding: all of the roughly $87 million in stolen SOL has been swapped, bridged or mixed, much of it ending up as bitcoin. Between 3 and 4 November about 725,000 SOL, worth $67 million, left in 204 transfers to 77 new wallets. NEAR is being peeled off in batches of about 400 tokens across roughly 40 accounts. About 12,200 ETH, most of it proceeds from the SOL sales, went through THORChain into bitcoin by the evening of 4 November.

What the mixers add is modest so far. Since 1 November about 33 BTC, worth $2.5 million, has gone through Wasabi-style coinjoins, and since 3 November about $1.1 million in ETH and SOL has been deposited into the Privacy Cash pool, which paused deposits for about a day after the theft became public. Against a $6.43 billion haul, those numbers are small. They are also the first places where the trail stops being linear.

Why this is slower than Bybit, and why slower is not better

Bybit lost 499,000 ETH in February 2025 and all of it was laundered within ten days. Here, $1.33 billion of ether was stolen and $3 million of it, about 0.23%, has moved. Elliptic gives three reasons for the difference: the sums are more than twice as large, moving them quickly would mean taking large losses on swaps, and the addresses are public, so services are watching.

The pace itself is the calculation worth keeping. About $124 million was converted in the seven and a half days to Elliptic’s 08:45 UTC snapshot, a little over $16 million a day. At that rate the $3.11 billion still parked would take close to six months to convert, and every additional freeze lengthens the runway.

“The Binance laundering is slower so far,” the report says. Slower is not safer for anyone. A patient launderer holding a published address list has decided that time costs less than slippage, and the Bybit precedent shows the eventual route: swap into bitcoin in small pieces, then cash out over months through OTC brokers. The absence of a cash-out so far says nothing about intent. It says the sale has not started.

The countercase: 44% frozen is not 44% returned

Freezing is not recovery. The $2.85 billion is held by issuers and authorities pending forfeiture or return, and it only exists because the assets frozen had an issuer willing to act inside minutes. Bitcoin and ether have no equivalent lever, which is why the launderers steer toward them. Elliptic is direct about the limits of repeating the trick. “Further freezes will be harder. Freezing 44% of the stolen funds is already unusual,” it writes, noting that only about 3% was frozen after Bybit.

There is a second reading of the parked balance that deserves a hearing: a state actor holding bitcoin does not have to sell on anyone’s schedule. The $1.39 billion in the 19 bitcoin addresses could be a reserve rather than a pending sale. That is a forecast, though, and the evidence for it does not exist yet. There has been no movement, no named counterparty and no seizure, and the Bybit case ended in conversion and OTC cash-out rather than a hoard.

On the victim side the picture is separate from the criminal one. Binance has said it covered the shortfall from its own balance sheet, replenishing 98% of the stolen funds within days, which moves the loss from depositors to the exchange and its insurers. How the breach itself was executed, including the tampered AI coding tool and the fake recruiting interviews behind it, is set out in Binance’s own account of the six-month campaign.

The AI-agent story does not survive the timestamps

The speed of the laundering invited a narrative that autonomous agents are now running the operation. Elliptic tested the strong version of that claim and rejected it. The evidence points to conventional automation: fixed timing, set amounts, blind retries, and new tactics introduced in steps hours apart, with pauses that look like human working patterns. “Nothing we have seen shows an AI agent making decisions,” the report says. The distinction is practical rather than academic. Scripted batching can be caught with address labels; genuine agent discretion would change what a screening model has to detect.

The report’s own limits are worth stating plainly. It covers on-chain activity only to 08:45 UTC on 6 November and warns the description may be incomplete because the funds are moving fast. It cannot attribute individual wallets, cannot show whether the parked balance has changed hands off-chain, and cannot confirm the eventual cash-out route, only the precedent. The $16 million that has reached addresses also holding proceeds of the September Bitget exploit is an overlap in infrastructure, not proof that the same people moved both.

What a compliance desk can act on

For institutions the operational facts are narrow. Nearly 18,000 labelled addresses, a free public blocklist, an FBI list published on 31 October, and a conversion flow currently concentrated in bitcoin arriving from THORChain swaps and from Solana and XRP sales. A desk that receives bitcoin from a freshly created address, or from a bridge payout with no history, is handling flow with a published taint score. The Bitget overlap gives screening teams a second cluster to check against the same wallets.

The market context is a separate question, and it should stay separate. Bitcoin traded at $75,832 on 7 November, down from near $80,000 in late October. Nothing in Elliptic’s data establishes that laundering flow moved the price, and the report does not argue it. At 1.9% of the haul, the converted bitcoin is too small to stand in for a supply shock in either direction. What it represents is potential supply sitting in wallets that are now labelled.

Three signals that would change this read

The first is movement from the nine large ether addresses. Elliptic expects the ether to be swapped into bitcoin in many small transactions before any cash-out, so a first batch out of those addresses starts a clock. The second is a deposit into a named venue: a large transfer to an exchange, a broker or a bridge with public flow data would convert the forecast into an observed event. The third is another freeze disclosure, because each one narrows the balance that can still be moved and lengthens the runway the attackers need.

The invalidation condition is simple. If the nine addresses begin moving in size, the parked-reserve reading fails and the timeline compresses toward the Bybit pattern of ten days. Until then the measurable facts are these: 93% of the haul sits in two buckets, frozen or parked, and 1.9% has been converted into bitcoin. That is a flow story with a long tail, and the tail is where the money either reaches a counterparty or does not.

Frequently Asked Questions