$3.11 Billion From Binance Theft Remains Parked as XRP Starts Moving

Roughly $3.11 billion from the record Binance theft remains parked in wallets linked to the attackers, even as the stolen XRP has started moving through cross-chain routes.

That split is the most important part of the latest blockchain picture. The laundering operation is active and sprawling, but the biggest pools of Bitcoin and Ether have not yet moved.

Decrypt reported that Elliptic now estimates about half of the $6.43 billion haul is still sitting in linked addresses, with the largest untouched pools concentrated in Bitcoin and Ether. A further $2.85 billion, or 44% of the theft, has been frozen or seized, mostly because stablecoin issuers such as Tether and Circle acted quickly within the first hour.

The XRP portion is now in motion. Elliptic said about $50 million has been swapped, mostly through THORChain into Bitcoin, while approximately $226 million in XRP remains to be moved.

Binance hack update: the XRP has started moving. About $50 million has been swapped, mostly through THORChain into BTC, with about $226 million still to move.

Bitcoin converted from other stolen assets is now about 1,650 BTC ($124 million), almost twice the figure a day earlier.…

— Elliptic (@elliptic) November 6, 2026

A huge machine with surprisingly little cashed out

The laundering network is anything but small. Elliptic says it has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions.

That works out to roughly one new wallet every 30 seconds.

Yet the movement has been uneven. The 18,270 Bitcoin stolen in the attack, worth about $1.5 billion at the time, was divided among 19 addresses and has not moved.

Nine major Ethereum addresses holding 89% of the attacker’s ETH have also remained still since Oct. 30.

The active routes have touched several networks. About $220 million in TRX moved through Tron before much of it was bridged to Ethereum.

The stolen Solana has been swapped, bridged or mixed. About $124 million from other stolen assets has now been converted into Bitcoin, much of it through THORChain.

North Korean-linked actors have begun a new phase of laundering the funds stolen from Binance.

After draining $500M from TRON staging wallets, the launderers have started moving onto Solana.

The Reactor graph below shows the scale across blockchains. pic.twitter.com/Pt3az4tJ0Y

— Chainalysis (@chainalysis) November 1, 2026

The FBI has attributed the October 29 theft to North Korean hackers it calls TraderTraitor. North Korea has denied involvement.

Elliptic described the laundering as highly complex and clearly automated, but said it had not seen evidence that an AI agent was making the decisions.

Elliptic expects the attackers to keep converting assets into Bitcoin and then cash out gradually through over-the-counter brokers and exchanges. Its analysis distinguishes laundering from cashing out, noting that only a negligible amount appears to have reached spendable fiat so far.

The firm compared the likely path with the 2025 Bybit theft, when stolen Ether was converted rapidly but disposal of the resulting Bitcoin took months. That history points to a long monitoring window rather than a single burst of movement.

Elliptic also said the automation is visible in the pace and repetition of wallet creation, but that this does not prove an AI system is choosing routes. Conventional scripts can execute an operation at that scale.

The parked Bitcoin and Ether therefore matter as much as the assets already moving. They represent the next potential phase, not money that has disappeared from view.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.