Blockchain analytics firm Elliptic said about $3.11 billion of the $6.43 billion stolen from Binance on October 29, 2026, remains in addresses linked to the theft, mostly in ETH and Bitcoin. It said those funds are “very likely” still held by North Korea. A further $2.85 billion has been frozen or seized, while only a negligible amount has likely been cashed out.
The FBI attributed the theft to North Korean hackers it calls TraderTraitor; North Korea denied involvement. Elliptic said the laundering has used more than 20,000 wallets across 16 blockchains and at least 36 services. It expects the attacker to convert ETH into Bitcoin and cash out through brokers and exchanges over months, but said the activity so far shows conventional automation, not evidence of AI agents making decisions.
