Binance Hack One Week On: $3.11 Billion Still Sits in the Attackers' Wallets — 5 Numbers That Decide What Happens Next

$3.11 billion of the biggest crypto heist in history hasn't moved a cent. Eight days after hackers drained $6.43 billion from Binance, blockchain analytics firm Elliptic reports that nearly half the loot is still sitting in the attackers' wallets — mostly untouched ETH and BTC. The thieves stole the money in about four hours. Getting rid of it, it turns out, is the hard part.

That frozen pile is the most important number in crypto right now: it tells you how the heist is really going, how much pressure the attackers are under, and how safe your own coins are while the largest theft ever recorded slowly works its way through the system. Here is where every dollar sits, why North Korea is in no hurry to move it, and the five numbers that decide what happens next.

The $6.43 Billion in 5 Numbers

Before the where, the what. On October 29, 2026, attackers drained roughly $6.43 billion from Binance's hot wallets in the largest cryptocurrency theft ever recorded — more than four times the previous record, the $1.5 billion Bybit hack of February 2025. The FBI has attributed the attack to TraderTraitor, a North Korean hacking unit operating under the Lazarus Group umbrella. Pyongyang denies involvement. Here is the state of the money one week on, according to Elliptic's update of November 6:

Figure	Amount	What it means
Total stolen (Oct 29)	$6.43 billion	Largest crypto theft on record, across 10 blockchains
Frozen or seized	$2.85 billion (44%)	Mostly stablecoins, frozen by Tether, Circle and others
Still in attacker wallets	$3.11 billion (48%)	Mostly unmoved ETH and BTC, one week after the theft
Laundering footprint so far	20,000+ wallets, 16 chains, 65,000+ transactions	The largest laundering operation ever tracked
Customer funds restored	98% replenished by Oct 31	Binance covered losses from its own reserves and insurance

The split is the story. Stablecoins can be frozen — Tether and Circle can blacklist an address and the money stops dead. Bitcoin and ether cannot. That is why the frozen $2.85 billion is mostly stablecoins, and why the $3.11 billion that is still sitting there is mostly ETH and BTC. The attackers can only spend the part nobody can switch off — and moving it without getting caught is slow, grinding work.

Where the $3.11 Billion Sits Right Now

Elliptic's November 6 update is the most complete public accounting of the loot so far, and the headline is how little has happened to it. About $3.11 billion remains in addresses linked to the theft, most of it unmoved since the night of the attack — unusually high for a theft of this size one week in.

The money is spread across more than 20,000 wallets on at least 16 blockchains, routed through at least 36 different services in more than 65,000 transactions, according to Elliptic. That sounds like a lot of movement, and it is — but it is mostly the same money being split, swapped and re-split, not money reaching an exit. The core pile of ETH and BTC is still parked. As of November 1, the attackers still held roughly 420,000 ETH and 18,270 BTC; by November 6, the unmoved total had been revised up to $3.11 billion as more addresses were linked to the theft.

Why does the money sit still? Because every move is watched. The FBI, the Secret Service and IRS Criminal Investigation have formally attributed the theft to TraderTraitor and published a blocklist of more than 600 addresses. The moment tainted coins touch a compliant service, they can be frozen or flagged. So the attackers face a choice: move fast and lose the money to freezes, or move slowly and keep it — for months, maybe years. So far, they are choosing slowly.

That patience is itself a signal. When the Bybit hackers stole $1.5 billion in February 2025, the laundering took months of careful, piecemeal swaps through mixers and decentralized exchanges. The Binance haul is more than four times bigger, spread across far more chains, and the whole world is watching the wallets in real time. The $3.11 billion sitting still is not a sign the attackers failed. It is a sign they know the only way to keep it is to wait.

Timeline: How $6.43 Billion Vanished in Four Hours

The theft itself took an evening. The break-in took months. Binance's own post-mortem, published November 3, reads like a slow-motion disaster that nobody noticed until the money was gone:

• June 2026: the attackers begin learning the names of Binance's wallet-team engineers. A wallet DevOps engineer searches for a popular AI coding tool and installs it through a tampered Homebrew package — a supply-chain attack that plants the first foothold.
• September 2026: someone posing as a project director contacts a Binance software engineer on a job-hunting platform with a fake interview. The engineer opens a file. The attackers are inside his machine.
• October 20, 2026: using the compromised machine and an internal Binance AI tool, the attackers take control of two more engineers' computers — including one with permission to deploy software to the wallet systems.
• October 29, 17:15–19:56 UTC: the attackers log on, deploy a container with a malicious script, and drain the hot wallets over two hours and 41 minutes. At 20:05 UTC, five Binance hot wallets on the XRP Ledger send 233.46 million XRP to the attacker. The attackers also abuse Ethereum's EIP-7702 mechanism, using 50 pre-signed authorizations to give an attacker-controlled contract execution rights over a hot wallet.
• October 29, 23:56 UTC: the last unauthorized transfer — 2,961.9 ETH — finalizes. Binance pauses withdrawals. At 00:10 UTC on October 30, Binance signs a new authorization pointing the wallet's delegation at the zero address, finally clearing it.
• October 31: the FBI attributes the attack to North Korea's TraderTraitor unit. Binance says it has replenished 98% of affected tokens from its own reserves and insurance.
• November 3: Binance publishes its post-mortem. Co-CEO Richard Teng: "This was not a single mistake or a single breach. It was a campaign built over many months." Binance says it stopped 57 suspected North Korea-linked attacks this year alone.
• November 6: Elliptic updates its laundering tracker: $3.11 billion still sits in attacker addresses; $2.85 billion frozen or seized.

Notice what is missing from the timeline: no breached password, no stolen private key, no zero-day exploit in the blockchain itself. The attackers got in through a fake job interview and a poisoned software download, then waited for weeks until they held the right permissions. The $6.43 billion did not leave because crypto is broken. It left because a handful of humans clicked the wrong things, and the systems around them did not catch it for months.

The Laundering Machine: 20,000 Wallets, 16 Chains, 65,000 Transactions

Elliptic calls the laundering operation the largest it has ever tracked, and the numbers back that up: more than 20,000 wallets, sixteen blockchains, at least 36 services, more than 65,000 transactions in the first week alone. The pattern is familiar from the Bybit playbook — split the funds into thousands of small pieces, swap them across chains through bridges and decentralized exchanges, wash them through mixers, and slowly reconsolidate them into clean-looking wallets.

But scale changes the game. Swapping $6.43 billion is not like swapping $1.5 billion — every swap leaves a trail, every bridge has limits, and every mixer has finite liquidity. The half that is still sitting there is the hardest half: ETH and BTC that cannot be frozen but also cannot be spent without touching a service that will flag them.

There is also a clock running. The longer the money sits, the more addresses get identified and the more services block them. The $3.11 billion is not just unmoved money — it is a countdown. That is why analysts watch the wallets the way traders watch a chart: the first big movement will tell the market whether the laundering is working or failing.

What Happens Next: 3 Scenarios for the $3.11 Billion

Scenario	What happens	Probability	Market impact
Slow bleed (base case)	The attackers launder small amounts over 6–18 months, as they did after Bybit. Most of the $3.11B eventually reaches mixers and OTC buyers at a steep discount.	Most likely	Muted. Small, steady sell pressure; occasional headlines when a chunk moves.
Big freeze	A major swap service or bridge cooperates with investigators and freezes a large tranche mid-laundering, as stablecoin issuers already did with $2.85B.	Possible	Bullish for confidence. Proves the system can claw back even "unfreezable" coins.
Fire sale	The attackers dump a large amount quickly at a deep discount to OTC buyers, accepting heavy losses to exit fast.	Least likely	Short-term price pressure on ETH and BTC, then a relief rally once the overhang clears.

The base case is the boring one, and the most likely: a slow bleed, as happened after Bybit — 65,000 transactions to move less than half the money in a week. The attackers cannot get the coins to an exchange in size without being seen, so the real risk is not a sudden $3.11 billion sale but a drip-feed of laundered coins hitting the market quietly, month after month.

The wildcard is the freeze scenario. Stablecoin issuers froze $2.85 billion within days, and the Arbitrum Security Council helped freeze more. If investigators identify the bridges and swap services the attackers depend on, a big tranche of ETH or BTC could get stuck mid-route — a first: a large-scale recovery of supposedly unfreezable crypto, and a genuine deterrent for the next attack.

What This Means for Your Crypto: 7 Checks to Run Today

The hack hit an exchange's internal systems, not individual users — Binance says it replenished 98% of affected tokens, so customer funds were covered. But the aftershocks target ordinary holders: refund scams, fake compensation claims and phishing waves always follow a hack this big. Run these seven checks now:

1. Ignore every "Binance refund" message. Binance is not emailing, texting or DMing users about compensation. Any message offering to return your funds is a scam — full stop. We covered the refund-scam wave in detail in our Binance refund scams checklist.
2. Move long-term holdings off exchanges. Hot wallets are for trading, not storage — if you are not actively trading a coin, it belongs in cold storage. Our guide explains how to store Bitcoin safely in 2026 — 3.7 million BTC are already lost forever, most of them to exactly this kind of complacency.
3. Turn on a hardware key or authenticator app. SMS-based two-factor authentication is the weakest link in your account. The attackers in this heist got in through people, not cryptography — your account is defended the same way.
4. Check your withdrawal allowlist. If your exchange supports address allowlisting, turn it on. A hacker who gets into your account still cannot send funds to an unlisted address.
5. Never open job files or "coding tool" installers from strangers. The entire $6.43 billion heist started with a fake job interview and a poisoned download. If a recruiter sends you a file, that is the attack.
6. Verify every link yourself. Phishing sites mimicking Binance appeared within hours of the hack. Type the exchange address yourself; never click a link in an email or a social-media post.
7. Keep a small trading balance. The less you hold on any single exchange, the less any single incident can cost you. Spread across two or three reputable platforms if you trade actively.

What Most People Get Wrong About the Binance Hack

Myth 1: "Binance lost its customers' money." Wrong. Binance says it replenished 98% of affected tokens by October 31 from its own reserves and insurance funds. Customers were made whole; the loss sits with Binance, not with users. That is the difference between a regulated-scale exchange with a balance sheet and a small platform that would have folded.

Myth 2: "The hackers got away with $6.43 billion." Not yet, and maybe not ever. $2.85 billion is frozen, and the remaining $3.11 billion is the most-watched money on earth. Stealing crypto and spending crypto are two different problems, and the second one is much harder at this scale.

Myth 3: "Bitcoin and Ethereum are unsafe now." The blockchains worked exactly as designed — no chain was hacked, no consensus was broken. The failure was inside Binance's internal wallet-signing service and its employee security practices. Your coins on a hardware wallet were never at risk from this attack.

Myth 4: "North Korea will just cash out and buy missiles tomorrow." The laundering of the Bybit funds took months and recovered only a fraction at full value. Illicit crypto sells at a steep discount through shady OTC channels, and every transaction risks a freeze. The money is a strategic asset for Pyongyang, not a bank account they can draw on freely.

Myth 5: "Exchanges have learned their lesson." Binance says it stopped 57 suspected North Korea-linked attacks in 2026 alone. The attempts have not stopped — and the next one is already being planned. The lesson is not that exchanges are now safe; it is that the attackers only need to succeed once.

Why This Heist Changes the Whole Industry

North Korean hackers have now stolen about $12.8 billion in roughly 100 incidents since 2017, according to TRM Labs — and $7.4 billion of that came in 2026 alone, with North Korea accounting for 85% of all crypto stolen worldwide this year. Chainalysis counted $2.02 billion stolen by North Korean groups in 2025, a record at the time; the Binance heist alone is more than triple that annual total.

That scale is forcing changes years of smaller hacks never did. South Korea has ordered emergency checks on its exchanges. The FBI, Secret Service and IRS have published a joint blocklist of more than 600 addresses. Stablecoin issuers froze $2.85 billion in days. And the market noticed: Bitcoin slid to $73,708 on November 8–9, its lowest since August, as the heist, the midterm result and the looming November 10 CPI report piled up into the same week.

The uncomfortable truth is that the heist worked because the attackers understood something the industry keeps underestimating: the weakest point in crypto security is not the cryptography, it is the people and the processes around it. A fake job interview, a poisoned installer, an internal AI tool with too much access — none of that is a blockchain problem, and it can happen to any exchange, including the one holding your coins. That is why the $3.11 billion sitting unmoved matters more than the $6.43 billion stolen: proof that even the biggest heist in history can be contained, slowed and partially reversed — if the industry moves faster than the thieves.

FAQs

How much was stolen in the Binance hack?

About $6.43 billion in digital assets was drained from Binance's hot wallets on October 29, 2026, according to Binance and blockchain analytics firms. It is the largest cryptocurrency theft on record, more than four times the $1.5 billion Bybit hack of February 2025.

How much of the Binance hack money is still in the attackers' wallets?

Elliptic reported on November 6 that about $3.11 billion — 48% of the stolen funds — was still sitting in addresses linked to the theft, mostly unmoved ETH and BTC. A further $2.85 billion (44%) has been frozen or seized, mostly stablecoins.

Who hacked Binance?

The FBI attributed the attack to TraderTraitor, a North Korean hacking unit operating under the Lazarus Group umbrella, in an advisory issued October 31, 2026. North Korea denies involvement. The FBI, Secret Service and IRS Criminal Investigation have published a blocklist of more than 600 addresses linked to the theft.

Did Binance customers lose money?

No. Binance says it replenished 98% of affected tokens by October 31, 2026, using its own reserves and insurance funds, and customer funds were covered. Withdrawals were paused for about two days during the incident response.

Can the stolen Bitcoin and Ethereum be frozen?

Bitcoin and ether themselves cannot be frozen the way stablecoins can — Tether and Circle can blacklist USDT and USDC addresses, which is how $2.85 billion was stopped. But tainted BTC and ETH can be flagged by exchanges, bridges and analytics firms, which makes them very hard to sell. That is why nearly half the loot is still sitting untouched a week later.

Will the Binance hack crash Bitcoin's price?

Bitcoin fell to $73,708 in the days after the heist, its lowest since August, but the drop also reflected the US midterm results and the upcoming November 10 CPI report. The bigger risk is not a single dump — the attackers cannot move $3.11 billion quickly without being seen — but a slow drip of laundered coins reaching the market over months. For background on how institutional flows move the price, read our guide on what a Bitcoin ETF is and how spot ETFs work.

Conclusion

Eight days after the biggest crypto heist in history, the scoreboard reads: $6.43 billion stolen, $2.85 billion frozen, $3.11 billion sitting still. The thieves won the night of October 29 — and have spent every day since discovering that stealing the money was the easy part. Twenty thousand wallets, sixteen blockchains and 65,000 transactions later, nearly half the loot is still parked in the most-watched addresses on earth, and every move they make narrows their options further.

For the rest of us, the lesson is the same one this heist keeps teaching: the cryptography held, the people didn't. Keep long-term holdings off exchanges, ignore every refund offer in your inbox, and remember the next attack is already being planned — the only question is whether its target learned anything from this one. If you are new to crypto, start with our complete beginner's guide to buying Bitcoin in 2026 before you put a single dollar on any exchange.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency markets are highly volatile. Always do your own research before making any investment decision.