Where Did the $6.3 Billion Go? A Week of Tracking the Binance Hack

Published: 7 November 2026 This is a follow-up to "A $6.3 Billion Lesson: Inside the Binance Hack, and Exchange Security in the Age of AI Agents" (31 October). The fund-flow figures come mainly from Elliptic's update as of 08:45 UTC on 6 November and may change. This article is a technical and security discussion only and is not investment advice.

---

The short version

• Where the money is: By Elliptic's count, about $6.43 billion was stolen from Binance. About $2.85 billion of it (44%) has been frozen or intercepted, and about $3.11 billion is still sitting in theft-linked addresses, mostly as ETH and BTC. Elliptic estimates that the amount actually cashed out is "negligible."
• The two biggest piles have not moved: 18,270 BTC was split across 19 addresses on the day of the theft and has not moved since; of about $1.33 billion in ETH, only about $3 million has moved.
• What is moving is the "smaller coins": TRX, SOL and XRP are first broken up on Tron and other chains, then swapped into bitcoin through cross-chain bridges and THORChain. As of 6 November, about 1,650 BTC (about $124 million) had been obtained this way.
• Laundering is an automated pipeline: more than 20,000 wallets, 16 chains, at least 36 services and at least 65,000 transactions, with a new wallet appearing every 30 seconds on average. Elliptic's assessment: clearly automated, but with no evidence of an AI agent making the decisions.
• The incident report rewrote the story of the way in: the attackers lay in wait for about five months; the way in was a tampered developer tool and a fake job interview, and during lateral movement the attackers also used one of Binance's internal AI tools.
• There is little evidence so far for "Chinese laundering networks": Chainalysis traced several hundred thousand dollars into Chinese money-laundering organizations. About $1 billion "moving through laundering channels" is not the same as having been cashed out through Chinese laundering networks.
• The freeze rate is far above past cases: only about 3% was frozen in the Bybit case, against about 44% this time; the key is that about 54% of the stolen assets were stablecoins.

An update to the previous article: The previous article said, "There is no public evidence so far that AI was used in this attack." The 3 November incident report shows that the attackers used one of Binance's internal AI tools during lateral movement, though the report does not say how. Where the two differ, this article takes precedence.

---

I. A one-week timeline

All times below are UTC. Beijing time is UTC+8 and Tokyo time is UTC+9.

---

II. The incident report: five months in hiding

On 3 November, Binance published its first incident report. Its opening line: "This should not have happened." The report reconstructs, in order, how the attackers worked their way step by step toward the wallet signing system.

1. June: a tampered developer tool

An engineer on the wallet team, while searching for a popular AI coding tool, installed a tampered Homebrew installation package. According to The Verge, the package appears to have been spread through a malicious Google ad.

Binance's security team spotted the problem, replaced his computer and rotated his credentials. But the attackers already knew who he was, and which colleagues worked around him.

2. September: a fake job interview

Another engineer was contacted on a job platform by someone calling himself a "project director." There were two interview rounds: first a video call with a fake "HR" person, then an interview with the "CEO" of a company that did not exist. Finally, he was asked to download a coding assignment onto his work computer.

The assignment hid malware that replaced a legitimate developer-tool component with a malicious copy. Binance's report says that this zero-day malware was not detected by its endpoint security tools at the time.

3. 20 October: lateral movement with an internal AI tool

Using this infected computer and one of Binance's internal AI tools, the attackers took control of the computers of two more wallet engineers. The report does not say exactly how the AI tool was used.

On the first engineer's computer, the attackers found a token with container deployment permissions.

4. 29 October: the strike

• 17:15–19:56: The attackers logged into the third engineer's computer, used credentials stolen from the first engineer to deploy a container, ran a malicious script and got into Binance's internal wallet signing service.
• From 20:05: Five XRP hot wallets sent 233.46 million XRP to the attackers. Solana, Optimism, Bitcoin and Ethereum followed.

5. Two key admissions

• Pausing withdrawals alone could not stop all unauthorized asset transfers. Transfers continued after withdrawals were paused that night.
• An MPC wallet has no private key that can be "revoked immediately." The hijacked hot wallets signed with MPC (multi-party computation), so there was no single private key that could quickly undo the malicious authorization. Binance had to build a revocation process specially, and only cleared the delegation at 00:10 on 30 October, about four hours after the first transfer out.

6. Remediation

• Rebuild the affected wallet systems in a new environment;
• Rebuild the internal AI tool and its access controls;
• Replace the affected engineers' devices and revoke their credentials and tokens; scan all employee devices;
• Tighten risk controls on the wallet service;
• Engage independent security firms, set up a blockchain AI security research fund, and invest more in AI threat detection.

Co-CEO Richard Teng said independent experts would review this work. Binance also said it had blocked 57 suspected North Korea-linked threats this year.

Where AI showed up in the attack chain

Putting the report and the on-chain analysis together, AI appeared at three points in this incident:

1. The lure: the first engineer was compromised while searching for an AI coding tool.
2. The stepping stone: the attackers used Binance's internal AI tool to take control of two more engineers' computers.
3. The laundering: the laundering is highly automated, but Elliptic says that "nothing we have seen shows an AI agent making decisions."

---

III. Where the $6.3 billion is now

Why the figures differ

Binance's official estimate is about $6.3 billion, TRM Labs about $6.36 billion, Chainalysis about $6.4 billion and Elliptic about $6.43 billion. The differences come mainly from what is counted and when it is valued. The fund-flow analysis below uses Elliptic's figures throughout.

The big picture

As of 6 November (Elliptic):

• Frozen or intercepted: about $2.85 billion, or 44%, mainly USDT and USDC.
• Still in theft-linked addresses: about $3.11 billion, mainly ETH and BTC. Elliptic says this portion is "very likely still held by North Korea."
• In the laundering process or already beyond the tracked addresses: the two items above add up to about $5.96 billion, leaving a gap of about $470 million against $6.43 billion. This is our own calculation from Elliptic's figures; Elliptic did not give this number directly.

Binance's own published frozen figure also changed, from about $3 billion on 30 October to about $2.85 billion on 3 November. Binance has not explained the difference.

Asset by asset

In one sentence: most of the freezable stablecoins have been frozen, the large unfreezable BTC and ETH holdings are sitting still, and what is moving is mainly the smaller coins.

---

IV. The laundering pipeline: break up, swap, bridge, mix

1. Breaking it up

• By Elliptic's count, the funds have passed through more than 20,000 wallets, 16 chains and at least 36 services, in at least 65,000 transactions. On average, a new wallet appears every 30 seconds and a transaction happens every 10 seconds.
• Tron is the main battleground: about 32,000 transactions, peaking at about 1,300 in the hour starting 08:00 on 31 October. On Tron, each dollar changed hands about 9 times on average.
• Chainalysis has observed a fixed routine: many addresses first receive exactly 1 TRX, then receive a large sum, which they forward on.
• Chainalysis counts about $500 million passing through Tron, spread across more than 1,000 addresses. This figure includes the same money moving back and forth between wallets, so it is larger than Elliptic's figure of about $220 million.

2. Swapping into assets that cannot be frozen

About $3.46 billion (54%) of the stolen assets were stablecoins, the part the attackers most wanted to get rid of quickly:

• Tether: USDT was frozen 37 minutes after it reached Ethereum. But in those 37 minutes, about 434 million USDT had already been swapped into ETH on Uniswap and other decentralized exchanges.
• Circle: froze all $823 million of USDC the attackers received before any of it was swapped. The cumulative frozen amount Circle announced on 5 November is about $1.1 billion.
• Overall, about $786 million was swapped before the freezes took effect.
• Some TRX was also swapped into USDD, a stablecoin marketed as "unfreezable."

3. Bridging into bitcoin

• Within the first 2.5 hours after the theft, the attackers had used 6 cross-chain bridges.
• THORChain is the main route for swapping ETH and XRP into BTC. At 11:34 on 31 October, THORChain halted swaps on most chains after an Ethereum block reorganization exposed a refund fault (10 ETH was overpaid); it resumed late on 3 November, and the laundering restarted with it. As of 4 November, about 12,200 ETH (about $29 million) had been swapped into BTC through THORChain.
• On-chain researcher SomaXBT counted about $48.3 million swapped into THORChain and about $42.7 million coming out as of 1 November, with about 12% lost to fees and slippage. For the attackers, that is an acceptable "laundering cost."
• The BTC the attackers obtained by swapping other stolen funds keeps piling up: about 215 on the afternoon of 3 November, about 470 on the morning of 4 November, and about 1,650 (about $124 million) on 6 November. Elliptic believes most of the latest overnight increase came from XRP swapped through THORChain.

In its 31 October alert, the FBI specifically asked THORChain node operators to block related transactions. But in September this year, THORChain turned down a request from Bitget to block addresses, on the grounds that its emergency controls can only pause activity as a whole, not freeze individual swaps.

4. "Vault hopping" and mixing

• Vault hopping: on 31 October, 128 million TRX went through a JustLend vault, deposited from one address and withdrawn by 16 new addresses, cutting the direct on-chain link. Similar moves were seen on Solana and Tron.
• Coinjoin: since 1 November, about 33 BTC (about $2.5 million) has gone into WabiSabi mixing, with 101 to 491 inputs per round.
• Privacy Cash: received about 41 ETH and 9,600 SOL (about $1 million in total) on 3 November and about 2,300 more SOL on 4 November. The service paused deposits on 4 November and resumed them the next afternoon.

5. Merging with the Bitget loot

About $16 million went into addresses that also hold funds stolen from Bitget in September. The Bitget theft, about $388 million, was likewise attributed to North Korean hackers. Chainalysis sees this as one of the strongest pieces of evidence for attributing this case to North Korea.

---

V. "Chinese laundering networks": what is fact and what is speculation

On 5 November, Chainalysis said some of the stolen funds had flowed into Chinese laundering networks, and the news was widely reposted. But on a closer look, what each firm actually said is quite cautious:

• Chainalysis (as reported by BigGo Finance): traced "several hundred thousand dollars" into Chinese money-laundering organizations, a tiny fraction of the total stolen; about $2.42 billion in BTC and ETH has barely moved; about $1 billion is moving through what it identifies as laundering channels.
• Elliptic: the amount already cashed out is "negligible." The funds that are moving may already have been handed to Chinese laundering networks to process, but on-chain data cannot confirm this.
• Michael Barnhart of DTEX: TraderTraitor has in the past paid Chinese laundering networks a fee or a cut to move stolen assets on its behalf.

One distinction to draw: "about $1 billion moving through laundering channels" is not the same as "about $1 billion already cashed out through Chinese laundering networks." The latter fits neither Chainalysis's own figure (several hundred thousand dollars) nor Elliptic's (negligible).

Cashing out is the bottleneck

To turn on-chain assets into money that can be spent, you eventually need a counterparty: a centralized exchange or an over-the-counter (OTC) dealer. Take the Bybit case as a reference:

• In February 2025, the 499,000 ETH stolen from Bybit was fully laundered within 10 days, mostly into BTC;
• but cashing out took several months: the funds were swapped into USDT on Tron and then cashed out through suspected Chinese OTC services.

Elliptic expects the same rhythm this time: ETH split into small amounts and swapped into BTC, then cashed out over several months through OTC dealers and exchanges. That means there is still a window for interception, and the cash-out exit is exactly the best place to intercept.

North Korea's response

On 2 November, Kim Yo Jong, the sister of North Korean leader Kim Jong Un, issued a statement denying involvement, calling the US accusation a "trite provocation" and "absurd rhetoric." KCNA carried the statement the next day. Elliptic responded that its on-chain analysis supports attributing the case to TraderTraitor.

---

VI. Why 44% was frozen this time, against 3% for Bybit

1. Asset mix: about 54% of the stolen assets were stablecoins, and tokens like USDT and USDC have a built-in freeze function that the issuer controls. BTC and ETH have no issuer and cannot be frozen this way.
2. Speed: Tether acted within 37 minutes; Circle froze all the USDC before any swap happened.
3. Coordination: Ripple, World Liberty Financial, the Arbitrum Security Council and others also took part in the freezes.

But the power to freeze is itself contested. According to a 7 November report in the Seoul Economic Daily, lawsuits over freezing are running in both directions: a company has sued Tether, saying its USDT has been frozen for more than a year and still not released; separately, two Thai nationals have sued Tether, saying about $42.42 million in USDT was frozen without a court seizure warrant; and investors in the Drift protocol hack have sued Circle for not freezing in time. The US GENIUS Act requires issuers to freeze and burn assets under lawful orders, which must come from a court with jurisdiction or an authorized federal agency.

It bears repeating: a freeze is not a recovery. For frozen stablecoins to get back to Binance, the issuer has to burn the tokens and reissue them, which requires a legal process. There is no public information yet on any funds being returned.

---

VII. On Binance's side: withdrawals resume and the gap is refilled

• Withdrawals resume: on 1 November, Binance restored withdrawals in phases. Bitcoin came back first, after 2 p.m. Singapore time, and by 8:30 p.m. 15 networks were back, including Ethereum, BNB Smart Chain, XRP and Base. The first phase covers 15 tokens, including ETH, USDT and USDC.
• Outflows: according to DefiLlama data, net outflows on the evening of 1 November were about $3.5 billion. Co-CEO Yi He said part of this was transfers between Binance's own wallets. Another report said Binance's tracked assets recovered by about $3.4 billion over the following two days, but that figure cannot separate new user deposits from Binance's own buying to refill the gap.
• Replenishment progress: the share of affected assets replenished was about 95% on 1 November and 98% on 3 November. The money came from the corporate treasury, emergency funds and insurance funds. Yi He said this year's revenue would be enough to cover the loss. She also said: "We should have invested more in security earlier, and set stricter standards."
• Proof of reserves: Binance updated the wallet address list for its proof of reserves; from now on, all withdrawals go out from these new addresses.

---

VIII. Five lessons for security teams

1. "Interview assignments" are a high-risk way in

TraderTraitor's fake-recruitment playbook has been in use for years, and it worked again this time.

• Make it an explicit rule that no externally supplied code may be run on work devices;
• Run targeted social-engineering drills for engineers on a regular basis.

2. Developer tools are part of the supply chain too

Both ways in this time were developer tools: a tampered Homebrew installation package and a replaced developer-tool component.

• Install developer tools only from an internal mirror or from sources whose signatures have been verified;
• Monitor file changes in package-manager directories on developer computers;
• AI coding tools are popular, which makes them exactly where attackers plant lures; their installation channels need the same control.

3. Internal AI tools are a new privileged channel

An internal AI tool that can operate other computers on an employee's behalf is a ready-made stepping stone in an attacker's hands.

• Give internal AI tools their own identity and least privilege, rather than letting them inherit all of the user's permissions;
• Require separate authorization for operations that cross devices or systems, and keep complete audit logs;
• This matches the principle set out in the previous article: AI agents may hold the brakes, but not the keys.

4. Rehearse emergency revocation in advance

Binance's report admits that pausing withdrawals is not the same as stopping asset transfers, and that an MPC wallet has no private key that can be revoked immediately.

• Prepare emergency procedures such as "revoke an EIP-7702 delegation," "rotate signing key shares" and "freeze the signing service" in advance, and rehearse them regularly;
• Make the time "from detecting the anomaly to clearing the delegation" a performance metric. This time it took about four hours.

5. The cash-out exit is the best place to intercept

Stolen assets ultimately have to pass through an exchange or OTC dealer to be cashed out, and that can take months.

• Small and mid-sized exchanges, OTC dealers and payment services can also become laundering exits;
• Feed the addresses published by the FBI and the risk labels from on-chain analytics firms into deposit and transaction screening in real time;
• Set alerts for patterns such as "receives exactly 1 TRX, then a large sum" and "a new address forwards funds within minutes of receiving them."

---

What to watch next

• When the 18,270 BTC and the large ETH holdings start moving, and at what pace;
• Whether THORChain node operators respond to the FBI's call to block transactions;
• OTC cash-outs: whether news emerges of exchanges or OTC dealers freezing funds, or of seizures by law enforcement;
• Return of frozen funds: whether and when Tether and Circle return the money to Binance by burning and reissuing;
• Binance's follow-up reports: exactly how the internal AI tool was misused, and what the independent experts conclude.

SolanaLink provides cloud infrastructure, IT operations and AI agent implementation services. If your team is evaluating ways to harden the security of a trading system, wallet service, deposit risk controls or internal AI tools, please get in touch.

---

References

• Elliptic: How North Korea is laundering the $6.4 billion stolen from Binance (updated 6 November)
• Decrypt: $3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic
• Chainalysis: The $6.4 Billion Binance Hack: Tracing the North Korea Link
• BigGo Finance: Chainalysis Tracks $6.3 Billion Binance Hack, Some Funds Funneled Into Chinese Money-Laundering Networks
• FinanceFeeds: Binance Hacker May Be Moving Stolen Funds Through Chinese Money-Laundering Networks, Elliptic Warns
• HackerNoon: Binance's Post-Mortem Is Out. The $6.3 Billion Hack Started With a Job Offer.
• TNW: Binance says a fake job interview led to its $6.3B hack
• Kapitalexperte: Binance hack post-mortem: a fake job interview and an internal AI tool opened the door
• CoinDesk: THORChain's RUNE jumps 10% as North Korean hackers resume laundering Binance loot
• CoinDesk: North Korea denies role in $6.4 billion Binance hack after FBI points to TraderTraitor
• Cointelegraph (via TradingView): Binance hackers move 81% of stolen Solana, route funds via THORChain
• Blockchain.News: Circle Freezes $1.1B USDC After $6B Binance Exploit
• Seoul Economic Daily: Binance Hack Puts Stablecoin Issuers' Freeze Powers in Spotlight
• Bloomberg (via Insurance Journal): Binance Restarts Withdrawals as Questions Linger on Record Hack
• Crypto Briefing (via Cryptonews): Binance tracked assets climb $3.4 billion in two days after post-hack withdrawal restart