Elliptic: 44% of $6.43 billion Binance hack loot frozen as laundering hits 12,000 wallets
Thief spreads $6.43 billion across 12,000 wallets in four days
About $2.85 billion of the $6.43 billion stolen from Binance has been frozen or seized, according to blockchain analytics firm Elliptic. That is roughly 44% of the haul.
The attacker moved the funds across about 12,000 wallets on 11 blockchains in more than 40,000 transactions in under four days, Elliptic said in an analysis published Monday. The firm described the pace as about one new wallet every 25 seconds.
A wallet is a digital address used to hold and send crypto. Blockchain is the public record that tracks those transfers.
Key numbers from Elliptic's analysis
- About $2.85 billion, or 44%, of the stolen funds has been frozen or seized.
- The attacker used about 12,000 wallets on 11 blockchains and made more than 40,000 transactions.
- About $3.24 billion remains in addresses linked to the theft.
- Stablecoins made up $3.46 billion, or 54%, of the haul. Stablecoins are tokens designed to hold a steady value, usually tied to a national currency.
- About $786 million in stablecoins got away before freezes took effect.
Stablecoin issuers moved faster than the hacker
Speed mattered because stablecoin issuers can freeze their tokens. Tether froze the stolen USDT on Ethereum 37 minutes after it reached the attacker's wallet, Elliptic found. Circle froze all $823 million in stolen USDC before any of it could be swapped.
For comparison, about 3% of the funds were frozen or seized after North Korea's $1.5 billion hack of Bybit in February 2025, according to Elliptic.
Before the freezes landed, the attacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, borrowed 19,762 ETH on lending protocol Aave against another 59.9 million USDT, and traded 234 million USDT for Tron's TRX token.
FBI links the theft to a North Korean group
The draining of Binance's hot wallets began late Thursday. A hot wallet is a crypto wallet connected to the internet so it can send and receive funds quickly.
The FBI has attributed the theft to TraderTraitor, a North Korean state-linked hacking group, and published hundreds of linked addresses. Binance has pledged to cover all losses. It reopened withdrawals on Sunday and saw about $3.64 billion in net outflows in the first nine and a half hours.
Automation, but no sign of AI making decisions
The speed of the laundering led to speculation that AI agents were doing the work. Elliptic disagreed. It pointed to fixed timing, set amounts, blind retries and pauses that resemble human working hours.
The firm wrote that while the laundering is clearly automated, "nothing we have seen shows an AI agent making decisions." On Tron, which became the main route, activity peaked at about 1,300 transactions in a single hour.
Why more freezes will be difficult
About $3.24 billion remains in addresses tied to the theft, mostly ETH and 18,270 stolen Bitcoin that have not moved since the day of the attack. Elliptic believes those funds are very likely still held by North Korea, while money already being laundered may have passed to Chinese money-laundering networks.
Only a negligible amount appears to have been cashed out. Elliptic said further freezes will be harder because ETH and Bitcoin cannot be frozen. In its view, the best remaining chances lie with centralized services, where the funds will eventually have to surface.
What Elliptic expects next
Based on the Bybit case, Elliptic expects the attacker to swap its ETH for Bitcoin in small batches and cash out through over-the-counter brokers over a period of months. Over-the-counter brokers are intermediaries that arrange large trades outside public exchanges.
About $16 million has also flowed to addresses that hold proceeds of September's Bitget exploit, Elliptic said.
The Binance theft came during a rough stretch for crypto security. BTCPay Server urged merchants to switch off their servers amid reports of hot wallet attacks on Monday, and Brazilian exchange Mercado Bitcoin halted withdrawals after a $40 million hack. It is unclear whether either incident is connected to the Binance attack.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.