Wallet watch · Oct 29, 2026 breach · Attributed to TraderTraitor / Lazarus (FBI, Oct 31)

Binance hack — what the hackers hold

Of roughly $6.34 billion taken on Oct 29, about $2.85 billion is frozen and roughly $2.8 billion still sits in theft-linked addresses — most of it untouched. The two biggest piles, the original Bitcoin and the main Ethereum stash, have never moved. What's changing is at the edges: the XRP pile is now nearly gone — ~51M more XRP (~$53M) was swapped into Bitcoin on Nov 11–12, leaving only ~8.5M XRP (~$9M) of the 233.46M stolen, about 96% converted — and Tornado Cash deposits have climbed to ~11,000 ETH.

Snapshot: Fri Nov 13, 2026 Tracker update: Elliptic, Nov 13 · 07:30 UTC XRP tally: Elliptic, Nov 13 — now reflecting the Nov 10 XRPL ledger tally and the Nov 11–12 swaps Watch run: Nov 13 · morning EST Refresh: updated when the wallet watch reports new movement

Total taken

~$6.34B

Binance's figure. Elliptic tallies $6.43B. Oct 29, 2026.

Frozen / seized

$2.85B

Locked by Tether, Circle & others — hackers can't touch it.

Still in hacker wallets

~$2.8B

Remains in theft-linked addresses across 16 chains and 20,000+ wallets (Elliptic, Nov 13) — down from ~$3.0B on Nov 10 as the XRP pile drained.

Likely cashed out

~$0

Elliptic: “negligible” so far. Converted ≠ cashed out.

New · Nov 13

XRP nearly done — ~51M more swapped Nov 11–12, only ~8.5M XRP left

Elliptic's Nov 13 update (07:30 UTC) counts ~51M more XRP (~$53M) swapped through THORChain into Bitcoin on Nov 11–12 — including emptying the last of the six Nov 2 split addresses, the 33.46M XRP wallet that hadn't moved since Nov 2. Only ~8.5M XRP (~$9M) remains of the 233.46M stolen: the stash is now ~96% converted. Converted Bitcoin has climbed to ~4,100 BTC (~$285M), Tornado Cash to ~11,000 ETH (~$21M), and CoinJoins to ~150 BTC (~$10M); Privacy Cash shows no growth at ~$6.7M. Still unmoved: the 18,270 BTC in 19 wallets and the nine largest ETH addresses, untouched since Oct 30.

Source note: these figures are Elliptic's Nov 13 tally. The earlier Nov 10 XRP total below came from XRPL ledger data, ahead of Elliptic's page at the time — the two tallies are kept separate where they differ.

Nov 10

XRP offload jumps — 171.66M of 233.46M XRP now gone, ~61.8M left

An XRPL ledger tally on Nov 10 shows 171.66M XRP (~$190M) offloaded since the swaps began Nov 5 — about 33M XRP more than the last checkpoint (Elliptic, Nov 9: ~139M offloaded / ~95M remaining). Only ~61.8M XRP (~$68M) is left. Four of the six attacker XRP wallets have emptied into a single collection wallet, which has made 929 payments to 94 addresses — the route is swaps into BTC via THORChain.

Source note: this total comes from XRPL ledger data. At the time, Elliptic's tracker page still showed its Nov 9, 13:15 UTC update, so the XRP figure was not yet reflected there — Elliptic's Nov 13 update above has since caught up and moved past it.

Nov 8–9

First Tornado Cash deposit of the stolen funds — ~7,000 ETH (~$15M)

About 100 deposits into Tornado's 10 ETH pool and ~60 into the 100 ETH pool since Nov 8. Some of that ETH came from Bitcoin that had already been coinjoined, then swapped back to ETH through THORChain. Until now, the only Tornado link was 0.1 ETH used to fund the attack itself — this is the first time stolen money has gone in.

Same update: XRP swapped into Bitcoin had climbed to ~139M XRP (~$154M) as of Nov 9 (see the Nov 13 update above for the latest), CoinJoin mixing grew to ~130 BTC (~$10M), and a new trick appeared — ~117,000 NEAR (~$430K) washed through six homemade memecoins.

Coin by coin — what's still in their hands

“Still sitting” means the original stolen coins haven't moved since the theft. “On the move” means that pile is actively being swapped or laundered. Amounts are the trackers' latest figures — USD values move with prices. The XRP and converted-BTC figures are now Elliptic's Nov 13 tally; the Nov 10 XRPL ledger tally is kept in the XRP card's detail for comparison, since the two sources count differently.

₿

Bitcoin — the original stash

BTC · 19 WALLETS
Still sitting
18,270 BTC
≈ $1.37 billion

Split on Oct 29 into 19 wallets (17 × 1,000 BTC, plus 832.5 and 437.7 BTC) via a peel chain. Not one sat has moved since — only dust and plea messages sent in by strangers. This is the single biggest untouched pile.

MOVED0%
More detail
  • Last confirmed unmoved: Elliptic, Nov 13 — all 18,270 BTC in the 19 wallets still hasn't moved.
  • The ~150 BTC in CoinJoins and the ~4,100 converted BTC below are different Bitcoin — made from Tron, XRP, SOL and ETH swaps, not from this stash.
Ξ

Ethereum — the main stash

ETH · 9 LARGEST WALLETS UNTOUCHED
Still sitting
~$1.27B in ETH
only ~$3M has ever moved · 0.2%

The nine largest ETH addresses haven't moved since Oct 30. Separately, the hackers built up ETH early on — selling ~$325M of USDT and ~$158M of altcoins (UNI, ENA, PEPE, LINK, AAVE, ONDO, WLD) into it — then largely left it parked.

OF ORIGINAL ETH MOVED~0.2%
More detail
  • 214,720 ETH sat untouched in just two wallets in the first days (197,460 ETH + the 17,260 ETH pre-mixer staging wallet).
  • 17,260 ETH (~$38.8M) was staged Oct 30 in wallet 0x03b0…20ea “preparing to launder” — the Tornado deposits that finally followed came Nov 8–9.
  • One stash wallet holds 9,788 ETH of token-sale proceeds that has never been sent anywhere (Bitquery).
✕

XRP — nearly fully swapped into Bitcoin

XRP · VIA THORCHAIN
Mostly gone
~8.5M XRP left
≈ $9M remaining · of 233.46M XRP stolen

The last big pile to start moving — and now it's almost finished. Sat untouched until a Nov 2 split across six wallets, then swaps into BTC began Nov 5. On Nov 11–12 another ~51M XRP (~$53M) went through THORChain, including emptying the last of the six split addresses — the 33.46M XRP wallet unmoved since Nov 2. Only ~8.5M XRP is left: ~96% of the stash is converted.

OFFLOADED SO FAR~96% · ~225M of 233.46M XRP
More detail
  • Nov 5–6: ~42M XRP (~$50M) swapped. Nov 6–7: ~44M more (~$51M). Nov 7–9: ~53M more, reaching ~139M offloaded / ~95M left (Elliptic, Nov 9). Nov 9–10: ~33M more offloaded, per the XRPL tally — 171.66M offloaded / ~61.8M left. Nov 11–12: ~51M more (Elliptic, Nov 13), leaving ~8.5M.
  • Source note: the Nov 10 checkpoint (171.66M / 61.8M) is an XRPL ledger tally that ran ahead of Elliptic's page at the time; the current ~8.5M remaining figure is Elliptic's Nov 13, 07:30 UTC tally, which now reflects the XRPL-counted movement and the Nov 11–12 swaps.
  • THORChain halted XRP trading on Nov 7 — swaps from the hacker's accounts went through again from Nov 8 afternoon anyway.
₿

Bitcoin — converted from other coins

BTC · FROM XRP / SOL / TRON / ETH SWAPS
On the move
~4,100 BTC
≈ $285M accumulated

Bitcoin the hackers made by swapping other stolen coins — mostly XRP, plus SOL, Tron funds and some ETH, largely through THORChain. It climbed again as the last of the XRP drained (was ~3,350 BTC, ~$250M, on Nov 10). Some has already looped through CoinJoins and back into ETH for Tornado Cash.

GROWTH SINCE NOV 5 (~900 BTC)4.6×
More detail
  • Nov 13 (Elliptic): ~4,100 BTC (~$285M), up from ~3,350 BTC (~$250M) at Nov 10 — an increment of ~750 BTC (~$35M), mostly from the XRP route.
  • Tracker gap: Arkham's labelled addresses show only ~18,385 BTC total (original + ~115 converted) — Elliptic traces far more conversion activity. The difference is coverage, not a contradiction in the original stash.
Ⓝ

NEAR — barely touched, one strange trick

NEAR · ~$42M STOLEN
Mostly sitting
~$40M still held
only ~$2M of ~$42M has moved

NEAR is moving in small batches — ~412,000 NEAR (~$1.5M) split into ~400-NEAR lots on Nov 5 alone. The odd part: ~117,000 NEAR (~$430K) was washed through six memecoins the hackers minted themselves — FUK, OLCCL, MEILI, MMLI, DABI, SINU — buying with one set of wallets and selling into the same pool with another, so the proceeds look like trading profit.

MOVED~5%
More detail
  • Memecoin trading ran Nov 5–7 and stopped by Nov 8; the tokens are abandoned. Outside buyers were <1% of volume.
  • Similar pool tricks were seen on Tron, and a variant on Solana using existing thin tokens. The same tactic followed the 2025 Bybit hack (~$24M via a homemade Tron token).
◎

Solana — fully worked through

SOL · 970,554 STOLEN
Mostly gone
~430 SOL left
of ~$87–94M — 99.9% swapped, bridged or mixed

The first big pile to be fully processed. From Nov 1 the SOL was split across dozens of wallets, sold for USDC, bridged to Ethereum (Relay, then THORChain, plus ~$53M via Circle's CCTP bridge), bought as ETH, and swapped into BTC. A slice went into the Privacy Cash mixer instead.

CONVERTED / MIXED~99.9%
More detail
  • Nov 1: first 486,970 SOL (~$46.4M) converted via Relay. Nov 3–4: ~725,000 SOL left the main wallet in 204 transfers to 77 wallets.
  • 3,600 SOL also landed in a HitBTC hot wallet on Nov 3 — no freeze or sale confirmed.
T

Tron — the laundering workhorse

TRX / USDT ON TRON
Mostly gone
~$1M TRX left
~$220–230M ran through Tron

The hackers took ~$628M on Tron; Tether froze 378.7M USDT of it. The rest was churned through 1,000+ addresses and pushed out over every bridge that would take it. Only about $1M of TRX remains on Tron now.

OF UNFROZEN TRON FUNDS MOVED OUT~78% of ~$249M
Bridge split (cumulative)
  • Relay ~$48M · THORChain ~$44M · Chainflip $32.1M out · Symbiosis $16M out
  • Another $41.7M passed through Bitget Wallet — final destination unresolved.
  • At least 5.3M TRX (~$1.7M) went straight into 723 HitBTC deposit addresses, Oct 30–31.
  • Tron funds also commingled with the earlier $388M Bitget exploit — trackers say it's likely the same actor.
▦

The long tail — 130+ other tokens

ALTCOINS · MOSTLY SOLD OR FROZEN
Mixed
130+ tokens hit
~$279M dumped into ~123,400 ETH + $1.69M USDC early on

In the first two days the hackers dumped 130+ altcoins into ETH — including 7.02M UNI, 217.5M ENA, 7.77T PEPE, 2.57M LINK and 3.38B RSR. Two piles are frozen mid-fight: 8,425 ETH + 74M ARB (~$30M) seized by the Arbitrum Security Council, and 46.6M POL (~$4.5M) that Polygon may hard-fork to recover. ~$3.32M of altcoins was also accidentally sent to a token contract and is gone for good.

SPEEDMost selling happened Oct 29–31

No coins match that filter.

Into the mixers — the privacy-tool tally

This is the part the watch was built for: money entering privacy tools is the strongest sign this is a real theft being laundered, not an internal move. All three routes are now active.

Ethereum · since Nov 8

Tornado CashFirst use · Nov 9

Deposits have grown from ~7,000 ETH on Nov 9 to ~11,000 ETH (Elliptic, Nov 13), across the 10 ETH and 100 ETH pools. Some ETH arrived via coinjoined BTC swapped back through THORChain — BTC → mix → ETH → Tornado. Note the dollar figures: ~$21M now vs ~$24M at the earlier per-ETH price is a price move, not less ETH — the ETH count went up.

~11,000 ETH≈ $21M
Bitcoin · since Nov 1

CoinJoin (Wasabi-style)

Was ~33 BTC on Nov 4, ~88 BTC on Nov 7, ~130 BTC on Nov 9, now ~150 BTC (Elliptic, Nov 13). The newest inflows are mostly fresh THORChain payouts from the XRP swaps. Note: none of this BTC comes from the untouched 18,270 BTC stash.

~150 BTC≈ $10M
Solana · Nov 3–4

Privacy CashTrackers disagree

Elliptic now counts ~$6.7M and reports no growth since its last update. Bitquery's earlier recount found ~78,595 SOL in — about $7.7M — and said Elliptic undercounted; the tallies still don't fully agree, but both now sit in the same range. The service paused deposits Nov 4 to add screening.

~$6.7Mno growth · Elliptic, Nov 13
NEAR · Nov 5–7

Homemade memecoin pools

Six self-minted tokens (FUK, OLCCL, MEILI, MMLI, DABI, SINU), each paired with NEAR in its own pool. Stolen NEAR bought in from one wallet set and was collected as “trading profit” by another. Trading stopped Nov 8.

117,000 NEAR≈ $430K

How it moved — bridge & swap routes

Cumulative totals through Nov 6 (Bitquery), plus the Nov 11–12 XRP leg noted on the THORChain row. Routes overlap — the same dollar can cross two bridges — so don't add these to the holdings above. Total laundered or moved on: ~$333M as of Nov 6, and climbing since.

THORChain

The main engine — XRP, SOL-via-ETH, and Tron funds into BTC. Briefly halted XRP on Nov 7; hacker swaps resumed Nov 8. On Nov 11–12 it carried ~51M more XRP (~$53M) into BTC, emptying the last Nov 2 split wallet.

~$113M

Relay Protocol

Tron → Ethereum (~$16M in the first wave alone) and the first SOL → BTC conversion.

~$56M

CCTP (Circle's bridge)

SOL sold to USDC, bridged Solana → Ethereum, then to ETH and on to THORChain for BTC.

~$53M

Chainflip + Symbiosis

Tron escape routes once THORChain paused TRX: Chainflip took 49.47M USDT in 571 deposits ($32.1M out); Symbiosis took 49.71M TRX in 1,367 deposits ($16M out).

~$48M out

Exchange probes

Gate: $250K deposited — two accounts frozen. HitBTC: 3,600 SOL + 5.3M TRX in — no freeze or sale confirmed. Probes, not cash-outs.

~$2M+

How we got here

Oct 29, 2026

The theft — ~$6.34B out in hours

A compromised DevOps engineer's laptop (fake-recruitment / tampered AI tool, per Binance's initial report) led to unauthorized withdrawals. ~$325M USDT swapped to ETH at a >10% discount; BTC split into 19 wallets; funds commingle with the $388M Bitget exploit via THORChain.

Oct 30–31

The altcoin dump & first bridges

130+ tokens sold for ~123,400 ETH. Tron funds start escaping via Relay and Stargate; THORChain pauses TRX, so Chainflip and Symbiosis take over. FBI attributes the hack to North Korea's TraderTraitor on Oct 31.

Nov 1–2

SOL starts converting; first mixing

970,522 SOL begins converting to BTC via Relay. The 233.5M XRP stash splits into six wallets. First privacy-tool use: ~28 BTC through CoinJoins. A $250K Gate deposit gets frozen.

Nov 3–4

Privacy Cash; SOL nearly done

First Solana mixer deposits (later recounted at up to $7.7M). SOL conversion shifts to the THORChain route; by Nov 5 under 0.1% of the SOL remains.

Nov 5–7

XRP wakes up; memecoin trick

XRP → BTC swaps begin and accelerate (~86M XRP by Nov 7). CoinJoins jump to ~88 BTC. NEAR starts moving in batches, including the six homemade memecoins.

Nov 8–9

Tornado Cash — the line finally breaks

~7,000 ETH (~$15M) into Tornado Cash, XRP swapped reaches ~139M (~$154M), converted BTC hits ~3,000 (~$225M), CoinJoins reach ~130 BTC (~$10M). Still unmoved: 18,270 BTC and all but $3M of the main ETH.

Nov 10

XRP offload jumps to 171.66M

XRPL ledger tally: 171.66M of the 233.46M stolen XRP offloaded since Nov 5 — ~61.8M (~$68M) remains, ~33M more than the Nov 9 checkpoint. Four of six attacker wallets emptied into one collection wallet; 929 payments to 94 addresses, routed into BTC via THORChain. This total is from XRPL ledger data — Elliptic's page still showed Nov 9 at the time. Still unmoved: 18,270 BTC and all but $3M of the main ETH.

Nov 11–13 · Latest

XRP nearly finished — ~8.5M left; converted BTC hits ~4,100

Elliptic (Nov 13, 07:30 UTC): ~51M more XRP (~$53M) swapped via THORChain on Nov 11–12, including the last Nov 2 split wallet (33.46M XRP, unmoved since Nov 2) — only ~8.5M XRP (~$9M) remains, ~96% converted. Converted BTC reaches ~4,100 (~$285M), Tornado Cash ~11,000 ETH (~$21M), CoinJoins ~150 BTC (~$10M); Privacy Cash flat at ~$6.7M. ~$2.8B remains in theft-linked addresses. Still unmoved: 18,270 BTC in 19 wallets and the nine largest ETH addresses, untouched since Oct 30.

The read — theft, not an inside move

The test from the start of this watch: if the coins get sold, swapped, or pushed into privacy tools, it's a genuine theft. Every one of those has now happened — sell-offs, cross-chain swaps, CoinJoins, Privacy Cash, memecoin pools, and finally Tornado Cash. Trackers and the FBI attribute it to North Korea's TraderTraitor (Lazarus); North Korea has denied it.

What to watch next: the 18,270 BTC and the main ETH pile. If either ever moves, that's the biggest escalation since Oct 29. Until then, the story is the edges — the XRP pile is nearly exhausted (~8.5M left, ~96% converted into Bitcoin), Tornado Cash is up to ~11,000 ETH, and ~$2.8B still sits in theft-linked addresses waiting for its next move.