Elliptic: $3.1 Billion of Binance’s Stolen $6.4 Billion Still Hasn’t Moved, a Week Later

MakeCryippreferred on

• Of the roughly $6.43 billion stolen from Binance’s hot wallets on October 29, 2026, Elliptic’s updated analysis finds $2.85 billion has been frozen or seized while $3.13 billion remains in attacker-linked addresses
• The laundering footprint spans more than 20,000 wallets across 16 blockchains and over 36 services, involving more than 65,000 transactions
• Roughly $16 million was traced to addresses that also hold proceeds from the separate September 2026 Bitget hack, both attributed to North Korea’s TraderTraitor group

Elliptic’s continuously updated forensic breakdown of the Binance hack, last revised November 7, 2026, shows that nearly a week and a half after the theft, a substantial portion of the stolen funds remains unmoved and unlaundered. Of the approximately $6.43 billion drained from Binance’s hot wallets in a roughly four-hour window on October 29, Elliptic now estimates that $2.85 billion has been frozen or seized by exchanges and issuers cooperating with the investigation, while $3.13 billion still sits in addresses linked to the attackers, overwhelmingly held as bitcoin and ether rather than having been converted to other assets.

The scale of the laundering operation itself is considerable: Elliptic traces activity across more than 20,000 wallets spanning 16 different blockchains and more than 36 distinct services, encompassing over 65,000 individual transactions. Chain-specific detail in the update shows roughly $230 million laundered through Tron, with only about $1 million remaining there now, while roughly $100 million in XRP was swapped, mostly into bitcoin, leaving about $173 million still in XRP-denominated holdings. Ether and the NEAR token have seen comparatively little movement, with only $3 million of $1.34 billion in traced ether and $2.5 million of $44 million in traced NEAR having moved since the theft.

Mixing services have played a modest but notable role in the laundering effort so far. Elliptic identifies roughly 77 to 88 bitcoin, worth between $5.8 million and $6.7 million, passed through Wasabi-style coinjoin mixing, along with roughly $6.7 million in ether and solana funneled into Privacy Cash, a mixing service that briefly paused new deposits during the period. Separately, approximately $16 million was traced to addresses that also hold proceeds from the unrelated September 2026 hack of exchange Bitget, with both incidents attributed to North Korea’s TraderTraitor hacking group, a connection the FBI formalized on October 31, 2026.

Elliptic frames the current 44% interdiction rate as notably higher than past incidents of this scale. The firm points to the 2025 Bybit hack as a comparison point, noting that North Korean operatives managed to launder roughly 499,000 stolen ether within just 10 days in that earlier case, with only about 3% ultimately frozen, a far lower recovery rate than the one unfolding around the Binance theft so far.

The continuing, near-real-time nature of this kind of forensic tracking has become a standard tool for understanding how far state-linked hacking operations can run before law enforcement and industry cooperation catch up with them. The full, continuously updated analysis is published on Elliptic’s own website.