Where Is the $6.43B Binance Hack Money Now? $3.11B Still Sitting, $124M Turned Into Bitcoin — 5 Numbers That Decide What Happens Next

Eight days after the largest crypto theft in history, $3.11 billion of the stolen money has not moved at all. It sits in addresses linked to the theft, visible to anyone who cares to look, and — according to blockchain analytics firm Elliptic — very likely still held by North Korea. That single fact, from Elliptic's update of 6 November 2026, reframes the $6.43 billion Binance hack: this was not a smash-and-grab that ended when the money left the exchange. It was the start of a slow standoff between the thieves, the exchanges, and the investigators — and the next move belongs to whoever blinks first.

On 29 October 2026, between 20:05 and 23:56 UTC, attackers drained $6.43 billion from Binance across 11 blockchains — more than four times the Bybit hack, the previous record. Since then, nearly half the money has been frozen or seized, a small slice has been quietly converted into Bitcoin, and the largest pile has simply sat there, untouched, while the whole world watches the addresses. This article breaks down where every dollar went, how the attackers pulled it off without leaking a single private key, why the money has not moved, and the three scenarios that decide what happens next.

What Elliptic Found Eight Days After the Theft

Elliptic, whose co-founder Tom Robinson has tracked the stolen funds since the night of the attack, published its updated assessment on 6 November 2026. Of the $6.43 billion stolen, $3.11 billion — 48.4% — remains in addresses linked to the theft. A further $2.85 billion — 44% — has been frozen or seized. Around $124 million — 1.9% — has been converted into 1,650 BTC in newly created Bitcoin addresses. Only a negligible amount, in Elliptic's words, has been cashed out. These figures are estimates, not a bank statement: totals shift as new wallets are identified and exchanges confirm freezes. But the shape is clear, and it is unlike most large thefts, where funds scatter within hours through decentralised exchanges, bridges, and mixers. Here, almost half the money never left the starting blocks.

Elliptic's assessment that the idle funds are "very likely" still held by North Korea is an assessment, not proven fact. The FBI attributed the theft on 31 October to North Korea's TraderTraitor group, and Pyongyang denies any involvement. Attribution is built from patterns — the tools used, the laundering infrastructure, the timing, and overlap with earlier operations — not from a courtroom conviction, and readers should keep that distinction in mind.

The laundering operation itself is industrial in scale: more than 20,000 wallets across 16 blockchains, at least 36 services, and over 65,000 transactions, according to Elliptic and Hacken's analysis. Some $3.46 billion — 54% of the haul — was in stablecoins, which matters because stablecoins can be frozen by their issuers in a way Bitcoin and Ethereum cannot. The unfreezable assets — roughly 584,000 ETH, around 18,300 BTC, and 233 million XRP — were spread across more than 800 attacker-controlled addresses. Those are the funds that cannot be switched off by a phone call, and the ones investigators are watching most closely.

The Money, Bucket by Bucket

The simplest way to understand the aftermath is to divide the $6.43 billion into four buckets. Every dollar now sits in one of them, and the balance between them is what the coming weeks will change — or leave exactly where it is.

Bucket	Amount	Share of the $6.43B haul
Still sitting in theft-linked addresses	$3.11 billion	48.4%
Frozen or seized	$2.85 billion	44%
Converted into Bitcoin (1,650 BTC)	~$124 million	1.9%
Cashed out	Negligible amount	Close to 0%

The first bucket is the story. $3.11 billion sitting idle is not what a successful theft looks like: stolen crypto only becomes usable wealth once laundered and converted. The second bucket is the defenders' success — $2.85 billion frozen or seized, possible largely because so much of the haul was in stablecoins that issuers can freeze and exchanges can seize. The third bucket is the warning sign: around $124 million converted into 1,650 BTC in newly created addresses, reported by Chain Affairs from Elliptic's tracking. Bitcoin is the hardest asset in the haul to freeze and the easiest to hold indefinitely, so even a small conversion shows the operation is still active and still making decisions. The fourth bucket is almost empty — a negligible amount cashed out — which means that eight days after the biggest theft in crypto history, the attackers have barely converted any of it into fiat, property, or goods. Whatever their plan is, it is not a quick exit.

A Dated Timeline: 29 October to 6 November 2026

• Months before the theft: the attackers spent around four months inside Binance's systems, entering through a compromised DevOps engineer's laptop and pivoting deeper into company infrastructure.
• 29 October 2026, 20:05–23:56 UTC: the theft. In under four hours, $6.43 billion was drained across 11 blockchains — the largest crypto theft on record, over four times the Bybit hack.
• 29–30 October 2026: the stolen Bitcoin — 18,270 BTC, worth around $1.5 billion at the time — was split into 19 addresses within about 30 minutes. The nine largest hold 89% of it and have been idle since 30 October.
• 31 October 2026: the FBI attributed the theft to North Korea's TraderTraitor group; Pyongyang denies involvement. Binance completed a zero-knowledge Proof of Reserves snapshot, later extended to 44 tokens.
• 1 November 2026: Binance began reopening withdrawals in phases. Net outflows that day hit $3.64 billion — 2.1% of its assets.
• 2 November 2026: Binance completed its zero-knowledge Proof of Reserves, based on the 31 October snapshot.
• 2–6 November 2026: US spot Bitcoin ETFs saw around $1.28 billion in net withdrawals for the week, including $411.9 million on 6 November.
• 6 November 2026: Elliptic updated its report: $3.11 billion still sitting, $2.85 billion frozen or seized, around $124 million converted into 1,650 BTC.
• 7 November 2026: Bitcoin trades at around $76,000 — roughly 40% below its $126,156 all-time high.

How the Hack Worked — Without a Single Leaked Private Key

The most unsettling detail of the Binance hack is also the one that should change how every crypto user thinks about security: no private key was leaked. Binance has said it plainly — "We have found no evidence of any wallet private key leak" — and Hacken's analysis explains why that is both reassuring and terrifying. The attackers did not need a private key, because they found a way to make Binance's own wallet drain itself.

The operation took around four months, starting with the compromised DevOps engineer's laptop. From there the attackers pivoted into an internal withdrawal service container — infrastructure close enough to the movement of funds to be dangerous, and trusted enough inside the network to be powerful. Then came the execution: they weaponised EIP-7702, the smart-account standard that lets an ordinary wallet temporarily act like a smart contract, to rewire Binance's flagship hot wallet, "Binance 14", into a self-draining wallet. It emptied itself — and as treasury bots refilled it, it emptied itself again. And then a third time.

The Bitcoin extraction was surgical: 11 discrete transactions pulled out 18,270 BTC, worth around $1.5 billion at the time and around $1.39 billion at the current price of roughly $76,000. Within about 30 minutes it had been split across 19 addresses, and the nine largest hold 89% of it. Since 30 October, they have not moved. For the full technical breakdown, Hacken's analysis of the Binance hack is worth reading. The lesson for ordinary users is narrower: if a hack this sophisticated can succeed without a leaked private key, your own security cannot rest on a single point of failure. That is why the guides on how to store crypto safely with cold storage and seed phrase protection and what a crypto wallet actually is matter more after this hack, not less.

Why $3.11 Billion Has Not Moved

Why would thieves leave $3.11 billion sitting in plain sight? There are four plausible explanations, and the truth is probably a mix of all of them. First, the money may not be able to move safely yet. Every hop leaves a trace, and investigators have traced those hops in real time since the night of the theft. The stablecoin portion is effectively radioactive: any attempt to move it through a regulated exchange risks an instant freeze, and the $2.85 billion already frozen proves the net works.

Second, the thieves may be waiting for the heat to die down — the classic playbook for a theft this size. Steal big, go quiet, and let attention move on before slowly laundering funds over months or years. The $124 million Bitcoin conversion fits this theory: a small, careful test of a new route while the bulk stays put. Third, the pipeline may simply be congested. Moving $3.11 billion through mixers, bridges, and over-the-counter desks without triggering freezes takes time, counterparties, and liquidity — and thin, nervous markets make large flows easier to spot, with Bitcoin around $76,000 and ETFs seeing heavy outflows.

Fourth, the money may not need to move at all yet. If the FBI's attribution is correct and the funds are held by a state-linked actor, the stolen crypto can function as a strategic reserve — held for years and spent slowly. That is a very different threat model from a criminal gang that needs to cash out, and it is why the Fed and OCC checks on US banks after the Binance hack are part of this story. None of these explanations is proven. What is certain is that the money has not moved, the addresses are watched by every analytics firm and law enforcement agency in the world, and every day it stays still is another day for the frozen bucket to grow.

What Happens Next: Three Scenarios

Predictions about stolen crypto are predictions, not facts, so here are the three paths that matter, in order of likelihood based on what Elliptic has reported. The first, and most likely, is the slow bleed: the thieves keep the bulk parked and launder it in small tranches over months — more conversions like the $124 million into Bitcoin, more hops through fresh wallets, more tests of which routes are open. The frozen bucket grows slowly as some tranches get caught, and the headline number ticks down over a year rather than a week. This is the boring scenario, and it is the one already happening.

The second scenario is the sudden move: the thieves decide waiting is riskier than moving, and a large chunk shifts at once. The market would notice immediately — the addresses are public, analytics firms publish alerts in real time, and a billion-dollar movement would be the biggest crypto story of the year within minutes. The freeze rate on whatever moved would likely be high, which is why this is less likely than the slow bleed. The third scenario is the seizure: law enforcement and exchanges get ahead of the thieves, freezing stablecoins and seizing funds through the courts. The $2.85 billion already frozen shows this machinery works, and the $3.11 billion sits in known, watched addresses. But seizure at this scale is slow, legal, jurisdictional work — and the thieves' patience helps investigators, since every week the money sits still is another week to build the case. A fourth possibility, the least likely, is that the money never moves in any meaningful way and becomes a permanent monument to the biggest theft in crypto history: visible on-chain forever, spendable in theory, untouchable in practice.

What This Means for Your Coins

It is easy to read about $6.43 billion and conclude it has nothing to do with you. It does, in three practical ways. First, exchange risk is real, even at the largest exchange in the world. Binance says it replaced 98% of the stolen assets from its SAFU fund, its futures insurance fund, and its corporate treasury, and completed a zero-knowledge Proof of Reserves on 2 November, later extended to 44 tokens. Withdrawals reopened in phases from 1 November. But the $3.64 billion in net outflows that day — 2.1% of assets — shows many users decided not to wait and see. The practical lesson is in our guide to storing crypto safely with cold storage and seed phrase protection: keep what you are not actively trading in a wallet you control.

Second, expect scams. The ten checks to run before buying Bitcoin safely after the Binance hack are directly relevant now, because fake "recovery" offers, fake compensation claims, and fake Binance support messages thrive in exactly this confusion. Binance is not asking users to send funds to a "recovery address". If someone offers to recover money for you, they are the second hack. Third, the market context matters for anyone thinking about buying the dip. Bitcoin at around $76,000 is roughly 40% below its $126,156 all-time high, ETFs saw $411.9 million in net withdrawals on 6 November and around $1.28 billion across the week, and the stolen 18,270 BTC sitting in 19 addresses is a visible supply overhang. That does not mean Bitcoin cannot recover — it means buyers should understand the overhang exists, and that the basics of how a crypto wallet actually works are worth ten minutes before sending a transaction in a volatile market.

Frequently Asked Questions

Where is the $6.43 billion from the Binance hack now?

Per Elliptic's 6 November 2026 update, $3.11 billion (48.4%) still sits in theft-linked addresses, $2.85 billion (44%) has been frozen or seized, around $124 million (1.9%) has been converted into 1,650 BTC in new Bitcoin addresses, and only a negligible amount has been cashed out. These are Elliptic's estimates, and totals may shift as more wallets are identified.

Who stole the money from Binance?

The FBI attributed the theft on 31 October 2026 to North Korea's TraderTraitor group. Pyongyang denies involvement, and Elliptic's assessment that the idle funds are "very likely" still held by North Korea is an assessment, not proven fact.

How was Binance hacked if no private key was leaked?

Attackers spent around four months inside Binance's systems after compromising a DevOps engineer's laptop, then pivoted into an internal withdrawal service container. They weaponised the EIP-7702 smart-account standard to rewire the "Binance 14" hot wallet into a self-draining wallet, which emptied itself three times as treasury bots refilled it. Details are in Hacken's analysis.

What happened to the stolen Bitcoin?

Some 18,270 BTC — around $1.5 billion at the time, about $1.39 billion at roughly $76,000 — was extracted in 11 transactions and split into 19 addresses within 30 minutes. The nine largest hold 89% and have been idle since 30 October. Separately, around $124 million was converted into 1,650 BTC in new addresses, as reported by CoinStats from Elliptic's tracking.

Did Binance users lose their money?

Binance says it replaced 98% of stolen assets from its SAFU fund, futures insurance fund, and corporate treasury, and completed a zero-knowledge Proof of Reserves on 2 November, later extended to 44 tokens. Withdrawals reopened in phases from 1 November, though net outflows that day reached $3.64 billion. Users should verify balances and consider the cold-storage guidance in our guide to storing crypto safely.

Will the $3.11 billion ever be recovered?

That is a prediction, not a fact. The $2.85 billion already frozen shows recovery at scale is possible, and the idle funds sit in known, watched addresses. But the unfreezable assets — 18,270 BTC and roughly 584,000 ETH across 800-plus addresses — are far harder to seize, and a patient laundering operation could move them in small tranches over months. The most likely outcome is a slow bleed, not a sudden recovery or disappearance.

Conclusion

Eight days after the biggest crypto theft in history, the most important number is not the $6.43 billion stolen. It is the $3.11 billion that has not moved — sitting in plain sight, in addresses the whole world can watch. The $124 million converted into Bitcoin shows the operation is still alive and testing its options; the 18,270 BTC idle since 30 October shows it is also still waiting. What happens next — a slow bleed, a sudden move, or a seizure — will be decided in the open, on-chain, where everyone can see it. Keep watching the addresses, keep your own coins in a wallet you control, and do not believe anyone who offers to recover the money for you.