How North Korea Is Laundering the $6.4B Binance Theft

The funds stolen from Binance on October 29 are being laundered at machine speed, and any firm that touches exchange flows now needs crypto accounting software that can trace counterparties, tag exposure and keep an audit trail. Blockchain analytics firm Elliptic reports that in under four days the attacker used about 12,000 wallets across 11 blockchains and more than 40,000 transactions. About $3.24 billion still sits in addresses linked to the theft, so the exposure window for finance teams is wide open.

What happened and where the money is now

On October 29, $6.43 billion in cryptoassets was stolen from Binance, one of the world's largest exchanges. The funds sat on 11 different blockchains. Binance has said the attack began with a compromised engineer's laptop. The theft itself ran from 20:05 to 23:56 UTC. The FBI later attributed it to TraderTraitor and published the attacker's addresses. Elliptic's update was last refreshed on November 2, 2026, and it warns that the picture is moving quickly and may be incomplete.

The headline numbers

Elliptic's figures give a useful snapshot of the position as of its latest on-chain data:

Elliptic says a negligible amount has likely been cashed out so far. The funds that have not moved are very likely still held by North Korea. Those being laundered may already be with Chinese money laundering networks, which North Korea has used before.

Why the stablecoins mattered first

Because 54% of the haul was in stablecoins such as USDT and USDC, and issuers like Tether and Circle can freeze them, the attacker's first priority was to swap into assets that cannot be frozen, such as ETH and TRX. On Ethereum, Tether froze the stolen USDT 37 minutes after it arrived. Before that, the attacker swapped 434 million USDT for ETH on decentralized exchanges such as Uniswap, and borrowed 19,762 ETH on Aave against a further 59.9 million USDT. On Tron, it swapped 234 million USDT for TRX on SunSwap before Tether froze the rest. Circle froze all 823 million stolen USDC before any of it had been swapped.

How the laundering has unfolded

Elliptic describes a staged operation. None of the individual techniques is new, but combined they make tracing far harder.

Tron: splitting and bridging

After the first hour, almost nothing moved on Tron for about five hours. Then, at 02:19 UTC on October 30, a single distribution wallet began sending out 684.6 million TRX in small amounts to hundreds of new addresses. The funds spread across about 7,700 addresses. Within two and a half hours, the attacker made its first transfers through six different cross-chain bridges, mostly in test-sized amounts. Almost all of the TRX was paid out as ETH on Ethereum, and at least $147 million has been bridged out of Tron so far.

On October 31 the attacker added routes. From 03:36 UTC some TRX was swapped for USDD, a stablecoin that markets itself as censorship resistant. From 05:18 UTC, one address put 128 million TRX through a JustLend lending vault, depositing from one address and withdrawing to 16 new ones, with no direct transfer linking them. The distribution wallet also sped up, reaching as much as 37 million TRX an hour. Its last transfer came at 05:33 UTC on November 1, after 1,113 transfers in 51 hours.

Ethereum, Bitcoin and other chains

On Ethereum, arriving ETH was forwarded to newly created addresses that then went quiet. About 68,700 ETH is now spread across roughly 850 smaller addresses, most holding between 10 and 100 ETH. The nine largest addresses hold 89% of the attacker's ETH and have not moved since October 30. The 18,270 stolen BTC was split into 19 addresses and has not moved since.

Since November 1, other chains have started to move. NEAR was moved to new accounts from 07:00 UTC. Some parked ETH began moving again in lots of around 10 ETH. Around half of the SOL went to a new address. On November 2, all 233 million XRP was sent to six new addresses, where it remains.

The first mixing

For the first time, some of the stolen funds have been mixed. From 05:55 UTC on November 1, bitcoin from the Tron funds went into coinjoins using WabiSabi, the protocol behind Wasabi Wallet and similar tools. By 06:02 UTC on November 2, about 28 BTC ($2.2 million) had been put through 18 coinjoins, each with between 101 and 491 inputs. A coinjoin combines many users' bitcoin in one transaction, which breaks the visible link between coins going in and coming out. Elliptic expects, based on the Bybit case, that the attacker will swap ETH for bitcoin and then try to cash out through OTC brokers and exchanges.

Automation, not necessarily AI

The speed has prompted speculation that AI agents are moving the funds. Elliptic's reading is that the evidence points to conventional automation: fixed timing, set amounts, blind retries, and new tactics introduced in steps hours apart. There were also pauses that look like human working patterns. For practitioners the practical point is the same either way: the scale alone points to software, and manual tracing will not keep up.

What it means for firms and CFOs

For a B2B reader, the key risk is indirect exposure. Splitting funds across thousands of addresses means small, ordinary-looking deposits can trace back to the theft. Elliptic notes that smaller amounts stand out less to exchanges that screen incoming funds, and can be laundered in batches at a pace the attacker chooses. A client, counterparty or OTC desk could receive tainted funds without any obvious red flag.

Accounting and audit implications

Good digital asset accounting software and crypto bookkeeping software should let a team do four things quickly:

• Record the on-chain source of every inbound transfer, with wallet addresses and transaction hashes tied to ledger entries.
• Re-screen historical receipts against newly published address lists, since attribution and address sets keep growing.
• Document the decision when a flagged receipt is held, returned or reported, so an auditor can follow the reasoning.
• Separate affected balances for disclosure if a counterparty's assets are frozen or its withdrawals are limited.

If your firm holds balances at an affected venue, or lends to one, the question of impairment, restriction and disclosure sits with you and your auditor. This article does not set out a treatment, because that depends on facts and frameworks the source does not cover. What the source does support is the need for clean, timestamped records of every position and transfer, which is exactly what crypto accounting software is meant to provide.

AML and tax-side points

From an AML standpoint, the speed of the laundering shortens the time firms have to react. Our related coverage walks through what firms must do now after the TraderTraitor attribution and how automated laundering changes monitoring expectations. Firms should check that screening covers addresses on all 11 chains involved, not only Ethereum and Bitcoin, and that bridge and lending-vault hops are followed rather than treated as dead ends.

On the tax side, an accountant advising a client who received funds later linked to the theft should document how and when the funds arrived, the counterparty, and any steps taken once the link was known. Whether such receipts affect the client's reporting is a question for the relevant tax authority's rules and legal advice, and the source does not address it.

What individual filers should do

If you're an individual holding crypto on a major exchange, you didn't cause this, and there's nothing in the source suggesting regular customers must change their tax filings because of it. The practical steps are about records.

Keep your own records

• Export your transaction history from every exchange and wallet you use, and store it somewhere you control.
• Note the dates of any deposits, withdrawals or trades you made around the incident, especially if withdrawals were delayed.
• Be careful when receiving crypto from unfamiliar sources, including OTC buyers. Funds linked to a known theft can be flagged by the platform you deposit them into.

Good bookkeeping makes it far easier to show where your coins came from if a platform ever asks. If you use a tool for tracking, check that it records the on-chain source of each transfer, not just the amount and date.

Practical next steps this week

For firms

Load the FBI-published addresses and any vendor blocklists into your screening. Our coverage of the free Binance exploit blocklist is a starting point. Re-run recent inbound receipts against the lists, confirm your policy for holding and escalating flagged funds, and brief the engagement team on who signs off. Because Elliptic says the situation is evolving and its description may be incomplete, plan to repeat the screening as new addresses are published.

For individuals

Back up your records, keep deposits to sources you can identify, and avoid chasing discounted coins from strangers. If an exchange asks about the origin of funds, answer with documents rather than guesses.

Frequently asked questions

How much of the stolen Binance money has been recovered?

Elliptic reports that $2.85 billion has been frozen or seized. About $3.24 billion remains in addresses linked to the theft, mostly ETH and BTC, and a negligible amount has likely been cashed out.

Why did the attacker swap stablecoins first?

Issuers such as Tether and Circle can freeze stablecoins. Of the $6.43 billion taken, 54% was in stablecoins, so the attacker moved quickly into assets like ETH and TRX that cannot be frozen.

Is AI doing the laundering?

Elliptic says the evidence points to conventional automation, such as fixed timing, set amounts and blind retries, plus pauses that resemble human working patterns. It does not conclude that AI agents are involved.

How can crypto accounting software help with this kind of event?

It can link each inbound transfer to its on-chain source, support re-screening against updated address lists, and keep a documented trail of decisions for auditors. It supports your judgment but does not replace compliance review.

Do ordinary exchange users need to change their tax filings?

The source does not say so. Individuals should keep complete transaction records and check their own jurisdiction's rules or ask a qualified adviser if they have specific concerns.

Where this leaves you

The next stage, if Elliptic's Bybit comparison holds, is conversion to bitcoin and cash-out through OTC brokers and exchanges. That is where firms and individuals are most likely to meet the funds, so the records you keep now matter. For wider context, see our pillar page on crypto compliance reporting.

Source: Elliptic