Binance hack laundering involved about one new wallet every 25 seconds, as North Korean-linked actors moved stolen crypto through a sprawling network, blockchain analytics firm Elliptic reported on November 2. Elliptic counted about 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days, based on activity through 08:45 UTC. The firm said the observed laundering looked automated, but found no evidence that artificial intelligence directed the transfers.
Elliptic estimates the October 29 theft at $6.43 billion, while Binance initially put its loss at $6.3 billion. Elliptic estimated that $2.85 billion, or 44% of the stolen funds, had been frozen or seized. Binance said it would cover the stolen funds and reported on October 31 that it had covered 90% of the loss.
Binance hack timeline
- October 29, 2026: Binance said its hot wallets were compromised at about 20:05 UTC. Elliptic later placed the theft window between 20:05 and 23:56 UTC, affecting assets on 11 blockchains.
- October 30: Binance estimated the loss at $6.3 billion and said it would use its SAFU fund and corporate treasury to cover the stolen funds, rather than pass the financial impact to users. The exchange’s account is in its security incident update.
- October 31: The FBI attributed the attack to North Korea and identified the activity as TraderTraitor. It urged crypto services to block transactions linked to listed addresses. The FBI’s alert on the attack said the actors were converting funds primarily into Ether.
- October 31: Binance said it had covered 90% of the loss. It described BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC as fully backed, and said the remaining 10% consisted of less-liquid tokens it was still acquiring.
- November 2: Elliptic’s tracking showed about 12,000 wallets and more than 40,000 transactions across 11 blockchains in under four days, using activity through 08:45 UTC.
Background: how the Binance hack laundering works
Elliptic said the stolen assets had been split across about 7,700 addresses, with most laundering so far running through Tron and funds bridged to Ethereum. By 06:02 UTC on November 2, roughly 28 BTC, worth about $2.2 million, had also gone through 18 coinjoins, according to Elliptic.
Elliptic described the pattern as automated, but that does not establish that AI was involved. CoinDesk reported that Elliptic found no evidence of AI agents directing the transfers. The wallet and transaction counts describe the activity Elliptic observed through 08:45 UTC on November 2.
The frozen-fund and user-backing figures refer to different reported measures. Elliptic’s $2.85 billion estimate is the amount it said had been frozen or seized. Binance’s 90% figure refers to the share of the loss it said it had covered. The evidence does not say that the same share of stolen crypto had been returned to Binance or its users.
Reactions and market context
The FBI urged crypto services to block transactions linked to addresses it listed. The Block, citing an on-chain analyst, reported that about $242 million had been laundered through Tron over two days. It also reported that Tether had frozen 378.7 million USDT, while the analyst attributed about $140 million in outflows to Relay, THORChain, Chainflip and Symbiosis.
Decrypt compared Elliptic’s estimate that 44% of the Binance funds had been frozen or seized with about 3% for North Korea’s February 2025 Bybit hack. Elliptic reported that North Korea laundered all 499,000 stolen ETH in that earlier case within ten days, mostly by swapping it for bitcoin. Cashing out those funds then took months.
The supplied data does not establish a market move caused by this breach alone. At 20:13 UTC on November 2, Bitcoin traded at $76,826, down 1.2% over 24 hours; Ether was $2,248.53, down 0.35%; and BNB was $695.78, down 1.67%, according to CoinGecko data. The Crypto Fear & Greed Index was 37, classified as Fear, on November 2. These figures provide market context, not evidence that the hack caused the price changes.
| Asset | Price at 20:13 UTC, Nov. 2 | 24-hour change |
|---|---|---|
| Bitcoin (BTC) | $76,826 | -1.2% |
| Ether (ETH) | $2,248.53 | -0.35% |
| BNB | $695.78 | -1.67% |
The FBI’s attribution is official. Wallet counts and route analysis in the reporting come from Elliptic and on-chain analysts. Elliptic’s analysis is based on activity observed up to the times specified in its reporting.
Outlook for Binance hack tracking
Elliptic’s wallet and transaction counts are a snapshot of the activity it had observed through 08:45 UTC on November 2. The FBI has urged crypto services to block transactions linked to listed addresses. Further reporting or updates from those organizations may add to the picture, but the supplied evidence does not establish what will happen to the remaining stolen funds.
Binance’s commitment to cover the loss is separate from law enforcement recovery. Its October 31 update said it had covered 90% of the loss and was still acquiring less-liquid tokens that made up the remaining 10%. Elliptic’s estimate of frozen or seized funds is a separate figure and should not be read as an amount returned to Binance or its users.
FAQ
What does Binance hack laundering mean?
It describes the movement of crypto stolen in the October 29 incident through multiple wallets and blockchain networks. Elliptic reported about 12,000 wallets across 11 blockchains and more than 40,000 transactions in under four days, based on activity through 08:45 UTC on November 2.
How much of the stolen Binance crypto has been frozen?
Elliptic estimated that $2.85 billion, or 44% of the $6.43 billion it says was stolen, had been frozen or seized. This is an analytics estimate and does not mean that all those assets have been returned to Binance or its users.
Did AI control the wallet transfers?
Elliptic said the activity looked automated but reported no evidence that AI agents directed it. CoinDesk also reported that Elliptic had found no evidence of AI agents directing the transfers.
Sources
- North Korea Responsible for $6 Billion+ Binance Attack (www.fbi.gov)
- Security Incident Update #2 (2026-10-30) (www.binance.com)
- North Korea Is Laundering Binance Hack Loot at One New Wallet Every 25 Seconds (Decrypt)
This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrencies are highly volatile; always do your own research before investing.
For advertising inquiries, please email . [email protected] or Telegram
