Around half of the $6.43 billion stolen from Binance last month has yet to be laundered, blockchain analytics firm Elliptic said in a report updated on Friday. At $6.43 billion, the haul is more than four times the size of the $1.5 billion Bybit hack in February 2025.

About $3.11 billion remains in addresses linked to the theft, mostly in ETH and Bitcoin, and those funds are "very likely" still held by North Korea, Elliptic said. A further $2.85 billion, or 44% of the haul, has been frozen or seized — mostly stablecoins that issuers including Tether and Circle froze within an hour of the theft. That compares with around 3% frozen after the $1.5 billion Bybit hack in February 2025, according to Elliptic.

Only a negligible share of the stolen funds is believed to have been cashed out so far. Elliptic expects the attacker to swap the funds into Bitcoin and cash them out through over-the-counter brokers over a period of months, mirroring the pattern that followed the 2025 Bybit hack.

In an update posted on X on Friday, Elliptic said the stolen XRP had started to move:

Binance hack update: the XRP has started moving. About $50 million has been swapped, mostly through THORChain into BTC, with about $226 million still to move. Bitcoin converted from other stolen assets is now about 1,650 BTC ($124 million), almost twice the figure a day earlier.…

— Elliptic (@elliptic) November 6, 2026

The FBI has attributed the October 29 theft to North Korean hackers it calls TraderTraitor. North Korea has denied involvement.

Elliptic described the laundering operation to date as "highly complex and clearly automated." It has spanned more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions — roughly one new wallet created every 30 seconds.

The 18,270 BTC stolen from Binance, worth about $1.5 billion at the time of the theft was split across 19 addresses on the day of the hack and has not moved since. The nine largest Ethereum addresses, holding 89% of the attacker's ETH, have likewise been dormant since October 30.

How the funds are moving

The largest portion of the laundering so far — about $220 million in TRX — has run through Tron. A single distribution wallet sent 684.6 million TRX to hundreds of newly created addresses over 51 hours, including throughout the night in Pyongyang. Almost all of that TRX was subsequently bridged to Ethereumn
All of the stolen Solana, about $87 million at current prices, has been swapped, bridged or mixed. The attacker has also begun laundering the stolen XRP, with about $50 million converted so far and roughly $226 million still to move. In total, about $124 million has been converted into Bitcoin, much of it via the cross-chain service THORChain.

A smaller slice of the funds has been mixed. About 33 BTC, worth around $2.5 million, has passed through Wasabi-style coinjoins, while approximately $1.1 million in ETH and SOL has been deposited into the Privacy Cash pool, which paused deposits for about a day.

The speed of the operation has fueled speculation that AI agents are moving the funds, but Elliptic said the evidence points to conventional automation. "The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," the firm said.

Elliptic expects the attacker to swap the ETH for Bitcoin and then cash out through OTC brokers and exchanges over a period of months. After the Bybit hack, North Korea laundered all 499,000 stolen ETH within 10 days but took months to complete the cash-out, the firm noted. Until that cash-out plays out, the dormant Bitcoin and Ethereum addresses holding the bulk of the un-laundered funds, together with the pace of the remaining XRP conversions, are the main indicators to watch as the operation progresses.

Binance continues restoring services

Binance has continued to restore services in the wake of the theft. On Friday, the exchange said users can now verify that their balances are backed at least 1:1 using the zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange added that it aims to reopen withdrawals for all tokens on restored networks by the end of next week. Whether that target is met will be the next visible marker of Binance's recovery.