SECURITY ALERT · FOLLOW-UP

The biggest piles have not moved. The smaller ones are moving faster.

About 2,300 BTC, worth roughly $175 million, now sits in new bitcoin addresses after being converted from other assets stolen from Binance, blockchain analytics firm Elliptic said in an update stamped 08:00 UTC on Saturday 7 Nov.

A day earlier, at 08:45 UTC on 6 Nov, Elliptic’s figure was about 1,650 BTC ($124 million). The $6.43 billion theft on 29 Oct has been attributed by the FBI to North Korea’s TraderTraitor group; see the FBI’s attribution of the theft to North Korea’s TraderTraitor.

Converted is not the same as cashed out.

Elliptic still estimates that only a negligible amount has likely been turned into spendable money.

What moved overnight

All figures are Elliptic’s, as of 08:00 UTC on 7 Nov.

  • XRP: roughly 44 million XRP, or $51 million, moved out overnight. Most went through THORChain, the cross-chain swap protocol, and came out as bitcoin. About $100 million of the stolen XRP has now been swapped in total. Some 148 million XRP, or $173 million, is still held, the bulk of it in three addresses idle since 2 Nov.
  • Mixing: a further 53 BTC or so, worth $4 million, was sent through Wasabi-style coinjoins, transactions that pool many users’ coins to break the visible trail. That takes the total mixed this way since 1 Nov to about 88 BTC ($6.7 million).
  • NEAR: some 412,000 NEAR, worth $1.5 million, was drained from the main NEAR account in small amounts.

Much of the newly mixed bitcoin had just been paid out by THORChain, Elliptic said.

Why does the XRP go first?

What has not moved

The 18,270 BTC taken in the theft was split into 19 addresses within half an hour of the attack. It has not moved since, according to Elliptic.

The nine biggest ether wallets, with 89% of the stolen ETH between them, have sat still since 30 Oct. Only about $3 million of roughly $1.34 billion in stolen ETH has been laundered so far.

Elliptic counts about $3.13 billion, mostly ether and bitcoin, still sitting in theft-linked addresses. A further $2.85 billion has been frozen or seized, mostly stablecoins that issuers froze on the night.

By Elliptic’s count, the laundering has so far touched over 20,000 wallets, 16 blockchains, 36 or more services and 65,000-plus transactions.

So what is the pattern telling investigators?

The pattern

Elliptic says the attacker is converting the assets that can be frozen or are harder to sell into bitcoin first, the same sequence it saw after the Bybit hack in 2025.

Its expectation is that the ETH will be swapped into bitcoin next, followed by attempts to cash out through over-the-counter brokers and exchanges.

THORChain sits at the centre of that route again, a week after THORChain’s emergency pause a week ago briefly slowed the flow. Swaps resumed late on 3 Nov, Elliptic said.

For how the money left Binance in the first place, see our Post-Mortem of the Binance hack.

The trail is public. The exits are not.

When the 18,270 BTC finally moves, who will be watching the other end?

Corrections and new evidence: [email protected]

Related: Separately, Binance France has told customers all accounts will close on 31 Dec

This article is for information only and is not investment advice.