Elliptic: $3.1B in Stolen Binance Crypto Still Untouched

TL;DR

• Approximately $3.11 billion of the $6.43 billion taken from Binance remains in wallets linked to the October attack, primarily in Bitcoin and Ethereum.
• Elliptic identified more than 20,000 wallets, 16 blockchains and 36 services involved in the movement of funds.
• Around $2.85 billion has been frozen or seized, highlighting how blockchain transparency and coordinated action can help limit illicit activity.
  

  ---

More than $3.1 billion in cryptocurrency connected to the October 29 Binance attack remains largely unmoved, according to blockchain analytics firm Elliptic. Its latest assessment reveals a complex transfer operation across multiple networks, while a substantial portion of the assets remains traceable on-chain.

The findings offer an important perspective on blockchain security and transaction transparency. Although attackers have moved significant amounts through different protocols, the public nature of blockchain transactions allows analytics companies, exchanges and stablecoin issuers to monitor suspicious activity and intervene when possible.

Elliptic estimates that approximately $3.11 billion of the $6.43 billion haul remains in addresses associated with the operation, mainly in ETH and Bitcoin. The firm considers it highly likely that these holdings remain under North Korean control.

The FBI has attributed the attack to North Korean hackers known as TraderTraitor, although Pyongyang has denied involvement.

Cross-Chain Transfers Reveal An Extensive Operation

Elliptic’s investigation identified more than 20,000 wallets across 16 blockchains, at least 36 services and approximately 65,000 transactions. The activity averaged roughly one new wallet every 30 seconds, suggesting a highly automated process.

Bitcoin represents a particularly significant part of the remaining balance. The 18,270 BTC involved, valued at approximately $1.5 billion when the attack occurred, were distributed among 19 addresses on the same day and have not moved since.

Ethereum holdings also remain concentrated. Nine major addresses contain 89% of the attacker’s ETH, with no movement recorded since October 30.

Meanwhile, approximately $2.85 billion, equivalent to 44% of the total, has been frozen or seized. Most of these assets were stablecoins, with issuers including Tether and Circle responding within an hour of the incident.

Bitcoin Could Become The Next Destination

The investigation also identified substantial activity involving Tron, Solana and XRP. Approximately $220 million in TRX passed through a distribution wallet, while most of the stolen Solana was already swapped, bridged or mixed. Around $50 million in XRP had also been converted, with another $226 million remaining.

Elliptic expects the remaining Ethereum to gradually move into Bitcoin before reaching over-the-counter brokers and exchanges. The Bybit incident provides a relevant precedent, as North Korean operators converted the stolen ETH within 10 days but took several months to cash out.