North Korea's $6.4 billion Binance haul will take months to cash out, and 44% is already frozen

The people who stole about $6.4 billion from Binance last week have moved most of it around, but they have not yet turned it into spendable money. That is the central finding of blockchain analytics firm Elliptic's latest tracing note, and it is why CNBC reports that the cash-out is expected to take months. The Financial Times carries the same expectation in its own headline.

The numbers behind the laundering

Elliptic puts the theft, on Oct. 29, at $6.43 billion across 11 blockchains. Of that, $2.85 billion, or 44%, has been frozen or seized. Another $3.24 billion still sits in addresses linked to the theft, mostly bitcoin and ether. Elliptic says a negligible amount has been cashed out.

In the first four days the attackers used roughly 12,000 wallets and made more than 40,000 transactions, about one new wallet every 25 seconds. Most of the early activity ran through the Tron network, where funds were spread over about 7,700 addresses before being bridged to Ethereum. At least $147 million has left Tron that way.

Why the freeze rate is unusual

About 54% of what was taken was in stablecoins such as USDT and USDC, which their issuers can freeze. Elliptic says Circle froze all 823 million stolen USDC before any of it moved, and Tether froze stolen USDT 37 minutes after it arrived on Ethereum. The attackers swapped about $786 million of stablecoins into coins that cannot be frozen before the locks landed. Elliptic notes that after the $1.5 billion Bybit theft in February 2025, only around 3% was frozen.

Why it is slower this time

After Bybit, the hackers moved all of the stolen ether within 10 days, according to Elliptic, and the cash-out then took months. This time the pace is slower. Elliptic gives three reasons: bitcoin and ether cannot be frozen, so there is no rush; the sum is more than twice Bybit's, and dumping it fast would cost the thieves in slippage; and the FBI has published the attacker addresses, so exchanges are watching. Elliptic expects ether to be swapped into bitcoin in small lots and then sold through over-the-counter brokers over several months.

The firm says the activity looks like conventional automation, not an AI agent: fixed timing, repeated amounts and automatic retries. It also says that the funds not yet moved are very likely still held by North Korea, while the funds being laundered may already have passed to Chinese money-laundering networks, which on-chain data cannot show.

Pyongyang denies it

Per CNBC, citing state media via Yonhap, Kim Yo Jong, the sister of leader Kim Jong Un, called the FBI's attribution to the TraderTraitor group a "grave political provocation." We cannot verify either side's claim independently; the attribution to North Korea rests on the FBI and on the blockchain firms' analysis.

What it means for the market

The overhang is a supply question. Roughly $3.24 billion of bitcoin and ether that the thieves control is a risk if it reaches exchanges quickly, though Elliptic expects the opposite. For scale, Bitcoin traded near $76,500 on Coinbase on Tuesday, about 2% below where it opened the day. Binance itself said on Tuesday it is reopening withdrawals for more assets on more networks and has replaced about 95% of the affected amount, per CNBC. Our earlier look at customer outflows is here.

More: live crypto prices.

Sources: Elliptic, Elliptic (Oct. 31), CNBC, Financial Times (headline), Coinbase Exchange. Information, not investment advice.