Crypto security and enforcement
Original publication: November 6, 2026, at 22:04:18 UTC+8. Figures and service-restoration plans below reflect that reporting date.
The FBI attributed the October 29 theft of $6.43 billion from Binance to North Korean hackers it calls TraderTraitor, according to Decrypt. North Korea denied involvement.
In a report updated on November 6, blockchain analytics firm Elliptic said $2.85 billion, or 44% of the stolen assets, had been frozen or seized. Most of that amount consisted of stablecoins frozen by issuers, including Tether and Circle, within an hour of the theft.
Elliptic contrasted that outcome with the February 2025 Bybit hack, when approximately 3% of the $1.5 billion stolen was frozen. The Binance figure combines assets frozen and seized; it does not establish that those funds had been returned to users.
Billions remained in theft-linked addresses
About $3.11 billion remained in addresses associated with the Binance theft, mostly in ETH and Bitcoin. Elliptic said those assets were “very likely” still held by North Korea.
The 18,270 BTC stolen from Binance—worth approximately $1.5 billion at the time—was divided among 19 addresses on the day of the attack and had not moved since. The nine largest Ethereum addresses, holding 89% of the attacker’s ETH, had remained inactive since October 30.
Other assets were moving through a large laundering network. Elliptic tracked more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions.
Approximately $220 million in TRX had been processed through Tron, with almost all of it bridged to Ethereum. All the stolen Solana, valued at approximately $87 million at the time of reporting, had been swapped, bridged or mixed. Roughly $50 million in stolen XRP had been converted, leaving about $226 million.
In total, approximately $124 million had been converted into Bitcoin, much of it through THORChain.
Automation, not demonstrated AI decision-making
Despite speculation that AI agents were moving the assets, Elliptic said it had found evidence of conventional automation, not AI-driven decisions.
The firm expected the attacker to exchange ETH for Bitcoin and cash out through over-the-counter brokers and exchanges over several months. That was a forecast, not a confirmed outcome.
On November 6, Binance said users could verify at least 1:1 backing of their balances through the zero-knowledge proof for its latest proof-of-reserves snapshot. The exchange also said it aimed to reopen withdrawals for all tokens on restored networks by the end of the following week.