Eight Days After the Binance Breach, $124 Million in Bitcoin Is on the Move

Following the massive $6.43 billion security breach executed between 20:05 and 23:56 UTC on October 29, centralized intervention achieved a historic mitigation milestone. Of the total haul, $3.46 billion (or 54%) was initially funneled into centralized stablecoins, primarily Tether ($USDT) and Circle’s USD Coin ($USDC). Because centralized token issuers retain contract-level freezing powers, the attackers faced an immediate race against compliance operators. Circle intervened decisively, freezing all 823 million stolen $USDC before a single token could be transferred. Meanwhile, Tether froze stolen $USDT on Ethereum within 37 minutes, though the perpetrators managed to swap 434 million $USDT for $ETH on decentralized exchanges and borrow 19,762 $ETH against 59.9 million $USDT via the Aave lending protocol. On Tron, the attackers swapped 234 million $USDT for $TRX on SunSwap prior to Tether freezing remaining balances.

By the conclusion of that week, roughly $2.85 billion had been successfully frozen or seized, while an estimated $786 million in stablecoins escaped through decentralized conversion windows. This intervention effectively neutralized 44.3% of the total stolen capital—a dramatic leap compared to the roughly 3% freeze rate recorded during the Bybit breach 21 months earlier. While 23 cents of every stolen stablecoin dollar slipped through before asset freezes landed, the remaining stablecoin float was rendered inert, denying the perpetrators the ability to utilize those specific tokens deeper in their laundering apparatus.

The Shift to Bitcoin and the Bottlenecks of Liquidation

With stablecoins compromised by issuer controls, the laundering strategy pivoted sharply toward native layer-1 assets. Elliptic highlighted the mechanical reasoning behind this transition: “$ETH and $BTC cannot be frozen, so there is no rush,” contrasting the deliberate pace of the Binance heist with the Bybit incident, where 499,000 $ETH was cycled in just ten days. However, converting unfreezable assets into fiat introduces severe off-ramping friction. Counterparties enforce strict Anti-Money Laundering (AML) monitoring, reinforced by Elliptic labeling nearly 18,000 linked addresses and the Federal Bureau of Investigation (FBI) circulating public blocklists.

Consequently, depositing large sums into centralized exchanges has become operationally prohibitive for the attackers, forcing cash-out attempts toward over-the-counter (OTC) brokers. Historical precedent points directly to this pathway; during the Bybit fallout, stolen assets were systematically converted to Tron-based $USDT and routed through suspected Chinese OTC networks. Blockchain tracking illustrates this progressive transition toward Bitcoin: after showing zero conversion volume on October 30, Bitcoin inflows tied to the hack reached $17 million by November 3, $37 million by November 4, and $124 million by the morning of November 6. At Bitcoin’s November 7 price of $75,832, the 1,650 $BTC accumulated in those conversion addresses stood at roughly $125 million.

Laundering Velocity Across Tron, Solana, and XRP

The Tron network served as the early operational engine for dispersing stolen holdings. Starting at 02:19 UTC on October 30, a primary distribution wallet began fracturing 684.6 million $TRX across approximately 7,700 addresses, generating 1,113 transfers within 51 hours. At its peak on October 31, the network processed approximately 1,300 related transactions in one hour—nearly one every three seconds. Laundering hops disguised the movement through complex smart-contract interactions; one address routed 128 million $TRX through a JustLend vault, depositing from one wallet and dispersing proceeds into 16 fresh addresses without direct wallet-to-wallet links. Around $147 million was bridged out of Tron into Ethereum, partially leveraging THORChain until the cross-chain protocol temporarily halted swaps due to an infrastructure fault. In total, approximately $220 million in $TRX was processed, leaving around $1 million untouched.

Other non-EVM assets have followed similar pipelines. All 233 million stolen $XRP was initially consolidated into six addresses on November 2 before shedding roughly 42 million $XRP (about $50 million) into Bitcoin via cross-chain bridges by November 6, leaving approximately 192 million $XRP valued at $227 million. The Solana component has completed its initial cycle, with all $87 million in stolen $SOL bridged, swapped, or mixed—including 725,000 $SOL exiting across 204 transactions to 77 destinations. By contrast, privacy mixers have seen minor utilization: roughly 33 $BTC ($2.5 million) passed through Wasabi-style coinjoins, alongside $1.1 million in $ETH and $SOL through Privacy Cash.

Dormant Ethereum Reserves and Conventional Scripting

Despite heavy bridging from ancillary chains, the bulk of the attackers’ core holdings remains static. Approximately 68,300 $ETH remains spread across roughly 830 addresses, but nine primary wallets control 89% of the total—amounting to roughly 60,800 $ETH worth $136 million at a November 7 price of $2,237.71. None of those nine addresses have registered outbound transactions since October 30. Similarly, 18,270 $BTC partitioned across 19 addresses within 30 minutes of the exploit remains completely stationary, holding an aggregate valuation of $1.39 billion. Elliptic assesses that this reserve is very likely still under the control of North Korean state operators, though on-chain keys cannot definitively clarify whether brokers have taken off-chain custody.

The deliberate operational rhythm has debunked theories that autonomous artificial intelligence agents are managing the illicit capital. Elliptic’s forensic examination found rigid transaction batching, fixed values, linear retry loops, and noticeable multi-hour operational pauses consistent with human working hours. As the analytics firm concluded, “Nothing we have seen shows an AI agent making decisions.” Observing the overall cadence, the report added that “The Binance laundering is slower so far,” reflecting an intentional strategy to minimize price slippage on decentralized markets rather than advanced autonomous execution.

Why This Matters

The Binance security breach provides critical empirical data regarding the evolving balance of power between decentralized exploiters and centralized compliance enforcement. The immediate neutralization of 44.3% of the exploit’s total volume proves that fiat-backed stablecoin issuers possess immense systemic capability to disrupt illicit flows when response windows shrink below an hour. As Elliptic observed, however, repeating such outcomes will prove challenging: “Further freezes will be harder. Freezing 44% of the stolen funds is already unusual.”

For decentralized finance (DeFi) protocols and institutional trading desks, the campaign reveals the laundering choke points that emerge once centralized tokens are stripped out. The reliance on cross-chain solutions like THORChain and decentralized lending pools like JustLend underlines how sophisticated actors exploit composability to break transaction heuristics without relying solely on traditional coin mixers. Furthermore, because Binance swiftly covered the loss—restoring 98% of depositor balances via its internal balance sheet—the immediate systemic fallout shifts from consumer liquidation risks to prolonged institutional monitoring of OTC settlement channels and secondary wallet clustering.

Frequently Asked Questions

How much of the total Binance exploit has been laundered so far?
As of 08:45 UTC on November 6, Elliptic confirmed that approximately $124 million—representing roughly 1.9% of the total $6.43 billion stolen—had been converted into Bitcoin from other digital assets. Another $2.85 billion remains frozen or seized by stablecoin issuers and law enforcement, while roughly $3.11 billion sits parked in labeled wallets awaiting liquidation. Asset conversion across bridges does not equate to a finalized cash-out into fiat currency.

Can law enforcement or issuers freeze the stolen Bitcoin and Ethereum?
No. Decentralized layer-1 native assets like Bitcoin and Ethereum lack central administrative issuers and cannot be frozen or rolled back at the protocol level. Centralized stablecoins like $USDT and $USDC incorporate smart-contract blacklisting capabilities, which allowed Tether to freeze stolen funds within 37 minutes and Circle to halt 823 million $USDC before any swaps could occur. Stolen Bitcoin and Ethereum can only be tracked, screened, or seized if transferred to compliant exchanges or custodians.

What is TraderTraitor, and how is the group connected to this breach?
TraderTraitor is an operational designation used by the FBI to identify advanced persistent threat actors operating on behalf of the North Korean government. The FBI formally attributed the October 29 Binance security incident to TraderTraitor on October 31, 2026, circulating a designated catalog of compromised addresses to global exchanges and virtual asset service providers to facilitate ecosystem-wide transaction blocking.

What is the status of the remaining XRP stolen in the exploit?
Following the initial theft, all 233 million $XRP was aggregated across six destination addresses on November 2. While approximately 42 million $XRP was bridged into Bitcoin through THORChain by November 6, roughly 192 million $XRP remains parked in the initial consolidation wallets, representing a market value of roughly $227 million based on a prevailing price of $1.18 per token on November 7.

This article is for information only and is not investment advice.