Elliptic Releases Free Binance Exploit Blocklist After $6.4B Hack
Elliptic has published a free, downloadable blocklist of blockchain addresses it has directly attributed to the $6.43 billion Binance exploit, the largest crypto theft on record. The dataset is available immediately as a CSV file, with API access to follow. Any firm that processes, custodies, or accounts for digital assets now has a practical tool to screen counterparties and close off laundering routes before the stolen funds reach their books. The sanctions dimension, tied to DPRK-linked actors, makes that screening an obligation, not just good practice.
What the Blocklist Contains and How It Was Built
Elliptic's investigators traced funds directly from the Binance exploit and attributed the addresses to the attack. The CSV snapshot represents verified attributions at the time of publication, and the firm has stated it will continue adding addresses as tracing work progresses. API access will allow automated ingestion once it goes live, making it suitable for integration into transaction monitoring pipelines.
Scale of the theft in context
Elliptic's analysis values the stolen amount at $6.43 billion. To frame that figure: it is more than four times the $1.46 billion taken in the Bybit exploit of February 2025, which at the time was itself described as the largest single crypto theft. The Binance exploit now supersedes that. Of the total, Elliptic has confirmed that $2.84 billion has been frozen. The remaining balance is live and moving through the industry, and Elliptic has flagged that laundering activity is expected to continue over the coming months.
Attribution to DPRK-linked actors
Elliptic has attributed the hack to actors linked to North Korea. That attribution carries direct regulatory weight: DPRK-linked entities are subject to sanctions administered by OFAC in the United States and by equivalent authorities in other jurisdictions. Any business that receives, processes, or facilitates the movement of these funds, even unknowingly, faces potential sanctions exposure. The blocklist is the mechanism to prevent that exposure from materialising.
Why This Creates Immediate Obligations for Crypto Businesses
Elliptic's previous free blocklist, released after the Bybit exploit, established a precedent. The firm's position is that making the data freely available to the whole industry multiplies the number of screening points, each one closing off another route the funds could take. The same logic applies here, at roughly four times the scale.
Sanctions exposure is not conditional on intent
OFAC's strict-liability framework means that processing a transaction involving sanctioned funds or sanctioned parties can create exposure regardless of whether the firm knew the funds were tainted. Once Elliptic has published a public blocklist and stated it is attributing the addresses to DPRK-linked actors, a firm that fails to screen and subsequently processes those funds will find it very difficult to argue it had no means of knowing. The publication of the blocklist, in effect, raises the knowledge threshold for the industry.
The laundering window is open now
Elliptic's guidance is explicit: the funds are moving now, and screening should happen now. Large-scale hacks attributed to state-linked actors follow a recognisable pattern: rapid fragmentation across wallets, routing through mixing services or cross-chain bridges, and eventual conversion through exchanges or OTC desks that have weak controls. The longer a firm waits to ingest the blocklist, the greater the probability that a flagged address passes through its systems undetected.
Accounting and Audit Implications for Firms and CFOs
For accounting firms, auditors, and CFOs with digital asset exposure, the Binance blocklist is relevant at several levels beyond the immediate AML screen.
Asset recoverability and impairment
Any firm or fund that held assets on Binance at the time of the exploit needs to assess recoverability. Under IFRS and US GAAP, a contingent asset that is not virtually certain of recovery cannot be recognised. Where assets are confirmed frozen or lost, an impairment or write-down is required. The $2.84 billion confirmed frozen introduces a separate question: if recovery is probable but not complete, management must document the basis for any carrying value with reference to the confirmed freeze and the ongoing tracing process. That documentation should reference the Elliptic analysis as a publicly available, verifiable source.
Disclosure obligations
Where the amounts are material, the exploit and any related asset position must be disclosed in financial statements. For firms that act as auditors of crypto-native clients, this is a risk area requiring heightened scrutiny in the current reporting period. Digital asset accounting software that ingests blockchain data can assist in identifying whether client wallets received any funds that trace back to the exploit addresses, supporting the completeness assertion in an audit.
Transaction monitoring integration
Firms using crypto bookkeeping software or digital asset accounting software to record and reconcile on-chain activity should assess whether their tooling supports real-time or near-real-time blocklist ingestion. A CSV download is the immediate option; API integration, once available from Elliptic, will allow continuous updates as new attributed addresses are added. Compliance teams should flag this to their technology providers and confirm the integration timeline.
Practical Steps: What to Do Today
The following actions apply to any firm that touches digital assets, whether as an exchange, custodian, OTC desk, fund administrator, or accounting and audit practice with crypto-native clients.
Immediate screening
Download the Elliptic CSV blocklist and run it against your current transaction monitoring and wallet screening systems. Identify any historical transactions involving the listed addresses and escalate for compliance review. If your systems cannot ingest a CSV directly, a manual check against recent high-value or unusual transactions is the minimum standard while a technical solution is prepared.
Policy and procedure updates
Update your AML policy to reference the DPRK attribution explicitly. If your sanctions screening policy relies solely on official government lists, OFAC's SDN list in the US and equivalent lists elsewhere, this event is a prompt to consider whether supplementary blockchain analytics feeds should be formalised as part of your screening process. Regulators in several jurisdictions have indicated that reliance on official lists alone is insufficient where blockchain analytics data is available and material.
Client and counterparty communication
Accounting firms advising crypto businesses should be reaching out proactively to confirm that clients have ingested the blocklist. Where a client is unable to demonstrate adequate screening, that is a compliance risk that needs to be documented and, where required, reported. For audit engagements, confirm whether the blocklist screening has been completed and retain evidence of that confirmation in the working papers.
Monitoring for updates
Elliptic has stated that investigators will continue to add addresses as tracing progresses. Set a process to check for updates regularly, and transition to API-based ingestion as soon as that access becomes available. The laundering pattern for state-linked hacks of this scale typically plays out over months, not days, meaning the blocklist will grow and the screening obligation will persist well into 2027.
Regulatory Context: DPRK, OFAC, and the Global Sanctions Framework
DPRK-linked cyber actors have been responsible for a series of high-profile crypto thefts. OFAC has designated multiple entities and individuals connected to these operations under its sanctions programmes. For US persons and US-nexus transactions, the prohibition is absolute: no transaction with a designated party or their property is permitted, and violations carry civil and criminal penalties. For firms outside the US, equivalent regimes apply in the EU, UK, and most major financial centres.
The practical consequence of the DPRK attribution is that the Binance exploit funds are not merely stolen assets: they are, in effect, sanctioned property. Every node in the financial system through which they pass takes on legal risk. The Elliptic blocklist is a tool to identify and block that passage. Read our earlier analysis of how OFAC actioned the DPRK IT worker crypto fraud network for additional context on the enforcement posture underpinning this attribution.
For a deeper treatment of the accounting and regulatory fallout specific to the exchange-level event, see our coverage of the accounting and compliance implications of the Binance hack and withdrawal suspension.
Frequently Asked Questions
What is the Elliptic Binance exploit blocklist?
It is a freely downloadable CSV file containing blockchain addresses that Elliptic has directly attributed to the $6.43 billion Binance hack. Elliptic is adding addresses on an ongoing basis as tracing continues, and API access will be available shortly after the initial release.
Does my firm have a legal obligation to screen against this blocklist?
There is no single law that mandates use of this specific blocklist. However, the DPRK attribution means the funds are connected to sanctioned actors. Under OFAC's strict-liability framework in the US, and under equivalent regimes elsewhere, processing transactions involving sanctioned property creates exposure regardless of intent. Failing to screen when a public, verified blocklist exists will be difficult to defend in any regulatory review.
How does the $6.43 billion figure compare to previous exploits?
Elliptic's analysis puts the Binance theft at more than four times the $1.46 billion taken in the Bybit exploit of February 2025. It is described as the largest single crypto theft on record.
What should our crypto accounting software or digital asset accounting software do with this data?
Your tooling should be able to ingest the CSV now and flag any address matches in historical or incoming transaction records. Once Elliptic releases API access, integrating a live feed will ensure your monitoring updates automatically as new addresses are added. Confirm this capability with your technology provider and document the steps taken.
How do we treat stolen or frozen assets in our financial statements?
Under both IFRS and US GAAP, assets that are not recoverable must be impaired or written down. Where recovery is possible but uncertain, management must document the basis for any carrying value with reference to verifiable evidence, such as the confirmed freeze amounts published in Elliptic's analysis. Material positions require disclosure. Auditors should treat this as a heightened risk area in the current period.
Source: Elliptic