After the Binance Hack, Nearly $2.85 Billion of Stolen Funds Frozen

According to the analytics company Elliptic, about $3.11 billion out of the $6.43 billion stolen from Binance on October 29 is still held in addresses linked to the attack. The funds are primarily in ETH and BTC. Elliptic believes that it is highly likely they are still controlled by North Korea. Another $2.85 billion, or 44% of the stolen amount, has been frozen or confiscated. Most of these funds are stablecoins blocked by Tether and Circle issuers within an hour after the theft. For comparison, after the Bybit hack in February 2025, about 3% of the stolen funds were frozen.

The laundering involved more than 20,000 wallets across 16 blockchains and at least 36 services. Elliptic recorded about 65,000 transactions – on average, a new wallet was created every 30 seconds. According to the company, the scheme is complex and automated, but there is no evidence of independent decision-making by AI agents.

The stolen 18,270 BTC valued at about $1.5 billion at the time of the attack were distributed among 19 addresses on the day of the hack. They have not moved since. Meanwhile, about $220 million in TRX passed through one address, which distributed 684.6 million tokens among hundreds of new wallets over 51 hours. Almost all these funds were then converted into Ethereum. The laundering of XRP has also begun: about $50 million has already been converted, with another $226 million yet to be moved. In total, approximately $124 million of the stolen assets have already been exchanged for Bitcoin, a significant portion through THORChain.

Elliptic expects the perpetrators to continue exchanging ETH for BTC and then cash out through over-the-counter brokers and crypto exchanges over several months. After the Bybit attack, North Korean hackers laundered 499,000 ETH in 10 days, but it took several months for the subsequent cash-out.

Meanwhile, Binance continues to restore service operations. The exchange reported that users can verify the backing of their balances at a ratio of at least 1:1 using proof of reserves based on zero-knowledge technology. The company also expects to restore token withdrawals on all already restored networks by the end of next week.