This updates my earlier assessment of why Binance survived the North Korean heist. Twelve days after the theft, 18,270 stolen bitcoin still sit in the 19 addresses they were split into on October 29, visible to anyone reading the blockchain and beyond any issuer's power to freeze. Around them, an automated laundering network has generated more than 65,000 transactions. In New York, a ruling from a smaller North Korean theft has already shown how frozen cryptocurrency attributed to Pyongyang can become contested property.
My earlier assessment argued Binance's capital decided whether it survived and administrative authority decided which stolen assets stopped moving. Both arguments still hold, and both now have limits. Most of the laundering data comes from Elliptic, whose running analysis, last updated November 9, puts the theft at US$6.43 billion across 11 blockchains. Binance's own figure is US$6.34 billion, and TRM Labs counts US$6.36 billion. The spread reflects valuation timing more than any dispute about what left the exchange on October 29.
The balance sheet also lost one of its stewards. On November 7, nine days after the theft, Binance Co-CEO Yi He announced Chief Financial Officer Kaiser Ng is leaving to pursue a new venture, with Airwallex finance executive Justin Yek replacing him. Yi He said the transition plan had been in place for about six months, and Changpeng Zhao said Ng discussed his startup months ago, according to Unchained. Zhao added his investment firm YZi Labs is always keen to back ventures founded by former colleagues.
The timing invites a story the evidence does not support. Two executives place the plan before the theft, and nothing public ties the departure to the loss. The departure still matters for a different reason. Binance survived by drawing on its Secure Asset Fund for Users (SAFU), its Futures Insurance Fund, and its corporate treasury. The executive responsible for the company's finances is now handing them to a successor mid-recovery, with SAFU partially deployed and its promised restoration to roughly US$1 billion not yet publicly confirmed complete.
Three different outcomes now hide behind the headline numbers. Customer restitution is largely done, because Binance replaced the stolen balances from its own reserves. Immobilization covers the US$2.85 billion frozen or seized, whose ownership and release remain unsettled. Recovery, meaning stolen assets actually returning to Binance to refill those reserves, has barely begun. A theft resolved for the depositor remains open for the institution paying the bill, and the durability of that arrangement depends on what reserves remain when the next crisis arrives.
Freezes Caught the Stablecoins and Little Else
The freeze record is far better than anything the industry has seen after a North Korean theft. Elliptic counts US$2.85 billion frozen or seized, about 44 percent of the total. After the February 2025 Bybit theft, about 3 percent was frozen. Tether froze stolen USDT on Ethereum 37 minutes after it arrived, and Circle froze all US$823 million in stolen USDC before any of it could be swapped.
The reason for the gap is structural. Stablecoins made up 54 percent of the Binance theft, and stablecoins have issuers holding the power to freeze them. Bybit's loss was almost entirely ETH, which has no issuer. The record freeze rate measures what PRESSURE CHOLLIMA (aka TraderTraitor) stole far more than how well the industry responded, and about US$786 million in stablecoins still converted into other assets before the freezes landed.
What remains tells the other half. Elliptic counts around US$3.0 billion still sitting in addresses linked to the theft, mostly ETH and BTC, and assesses the funds which have not moved are very likely still held by North Korea. The 18,270 BTC has not moved since October 29, and Elliptic reports the main ETH holdings have not moved either. Only about US$3 million of the US$1.27 billion in stolen ETH had moved as of November 9, Elliptic found, consistent with Decrypt's earlier account of the nine largest Ethereum addresses sitting idle since October 30.
No issuer can freeze native BTC or ETH. The largest share of the theft sits in plain view, beyond the reach of every administrative switch my earlier assessment described.
Around that stillness, the laundering of the smaller assets runs at machine pace. Elliptic counts more than 20,000 wallets and at least 65,000 transactions across 16 blockchains and at least 36 services. The launderers create roughly one new wallet every 30 seconds, and Elliptic calls the operation clearly automated while noting no evidence of an AI agent making decisions. All of the stolen SOL, about US$90 million, has been swapped, bridged, or mixed. About US$150 million of the stolen XRP has been swapped, mostly into bitcoin, with about US$105 million left.
The laundering is converging on bitcoin. By November 9, the launderers had converted other stolen assets into roughly 3,000 BTC, worth about US$225 million. Elliptic also traced around US$16 million to addresses holding proceeds of the September Bitget exploit, which it also attributes to TraderTraitor.
Laundering Through Infrastructure Without a Switch
THORChain shows the limits of the authority-based recovery model. On the evening of October 31, the FBI attributed the theft to TraderTraitor, published the attacker's addresses, and urged THORChain node operators and other services to block linked transactions, according to Elliptic. Some transactions continued anyway, Gulf News reported, citing a Wall Street Journal investigation.
THORChain halted swaps on most chains on October 31 after a technical fault, not in response to the FBI, then resumed late on November 3. By the evening of November 4, Elliptic had tracked about 12,200 ETH, roughly US$29 million, moving through it into BTC. Most of the XRP laundering since November 5 has used the same route.
Developers told TokenPost they could not prevent North Korean threat actors from laundering through their platforms. That answer is technically defensible and strategically damning. A protocol designed without a freeze function cannot comply with a freeze request, however legitimate. Other services retain a switch and use it. The privacy pool Privacy Cash paused deposits for about a day after receiving about US$1.1 million in stolen ETH and SOL.
Polygon shows a switch can exist even without a token issuer. At Binance's request, the four block producers on Polygon PoS added an address holding 46.63 million stolen POL to their transaction block list. On November 4, Binance and Polymarket proposed a coordinated hard fork setting the balances of five blocked addresses to zero at a fixed block and crediting the same amounts to recovery addresses, with no signature from the wallets holding them. The proposal covers about 70.49 million POL in total, worth roughly US$6.5 million at October 29 prices, of which Binance's share is about US$4.3 million.
The sum is trivial against the theft, and the proposal has not been approved. Its significance lies in the mechanism. The proposal discloses the attacker contacted validators offering cash to help unblock a transaction, and its authors describe the fork as an extreme action not to be reproduced commonly. A forum respondent has already raised the precedent problem. Native tokens may lack an issuer, but the network maintaining their balances can still hold extraordinary power over them, and where that power sits varies from one blockchain to the next.
Elliptic also documented a newer disguise. On November 9, Elliptic's Tom Robinson detailed how the launderers minted six meme coins on NEAR between November 5 and 7 and paired each with real liquidity on a decentralized exchange. The launderers bought the tokens with stolen NEAR from one set of wallets and sold them through the same liquidity pools to collect assets in another. No direct transfer connected the buying wallets to the receiving wallets, though Elliptic followed the flow through the pools.
Each token cost about 25 NEAR, roughly US$90, to create, and each was traded heavily within hours and then abandoned. The volume is trivial. About 117,000 NEAR, roughly US$430,000, passed through the six tokens. Elliptic first saw the technique after Bybit, when the launderers created a worthless Tron token and moved at least US$24 million through it, and the Binance launderers adopted it within days of the theft. Meme coins launch by the thousands and die quickly, so one more abandoned token draws no attention, and each one adds hops an investigator has to unwind.
The mixing has started too. Since November 1, about 130 BTC, worth around US$10 million, has gone through Wasabi-style coinjoins. Since November 8, roughly 7,000 ETH, about US$15 million, has entered Tornado Cash. Because Elliptic reports the main ETH holdings unmoved, the Tornado Cash deposits most likely come from converted assets rather than the original stolen ETH.
The sequence matches the Bybit playbook. North Korea laundered all 499,000 stolen Bybit ETH within ten days, then took months to cash out through suspected Chinese over-the-counter brokers, according to Elliptic, which expects the same sequence here. So far, Elliptic assesses a negligible amount has likely been cashed out. The stolen value has changed form and scattered across thousands of addresses, but it remains on public blockchains, and turning it into money North Korea can spend requires a counterparty willing to take it.
As I noted in my examination of how crypto investigations follow stolen money, conversion to fiat is where blockchain intelligence meets regulated institutions with the power to say no. Funds sitting still may also reflect caution rather than strategy, with the threat actor waiting for scrutiny to fade or for over-the-counter capacity large enough to absorb billions. Either way, the unmoved balance is a reserve North Korea can draw down on its own schedule.
Control is less certain for the funds already in motion. Elliptic notes North Korea has handed stolen funds to Chinese money laundering networks in previous cases, and on-chain data cannot show whether that has happened here. The blockchain records movement between addresses, not who holds the keys. That distinction matters for sanctions enforcement, and as the next section shows, for any claim treating the stolen funds as North Korean property.
Attribution Now Has Creditors
The second argument of my earlier assessment held attribution was starting to carry financial weight it was never built to bear, mainly in insurance disputes. A case from earlier this year shows a second route, and it runs directly through the frozen assets.
In April, North Korean threat actors exploited Kelp DAO's rsETH bridge, according to LayerZero. Arbitrum's Security Council then froze 30,765 ETH, worth about US$71 million, and the affected protocols proposed its release through Arbitrum governance. Before the funds could move, attorney Charles Gerstein posted a restraining notice on the Arbitrum governance forum under New York civil procedure law. He represents three sets of terrorism judgment creditors of North Korea, including victims of the 1972 Lod Airport massacre and the family of Reverend Kim Dong Shik, holding roughly US$877 million in unpaid judgments.
The creditors' argument rests on attribution. US authorities link the threat actor behind the exploit to the North Korean state, so the creditors contend the frozen ETH is North Korean property, attachable under the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act. The counterargument, raised by Arbitrum delegates and Aave, holds the ETH is stolen property and a thief acquires no title to it.
The court has not resolved the dispute. On May 8, Judge Margaret Garnett of the US District Court for the Southern District of New York modified the restraining notice only to let Arbitrum's governance vote move the ETH to Aave, and reserved decision on everything else. Aave LLC agreed to remain bound by the notice, so if the creditors prevail, Aave could be compelled to surrender the funds. The judge declined Aave's request to vacate the notice or require a US$300 million bond, The Block reported.
Binance wrote that precedent into its own request. Its Constitutional AIP of November 5 seeks release of the 8,425.997 ETH and 74,559,805.2 ARB the Security Council immobilized and estimates the process at about 49 days. The proposal notes third parties have previously claimed assets immobilized on Arbitrum on the theory they belong to the people responsible for an exploit.
Binance will not submit the proposal or take delivery while any restraining notice or court order is in effect, and agrees to hold the assets untouched, defend any claim at its own expense, and turn them over to whoever a court finally determines is entitled to them.
The proposal also shows who now owns the loss. Binance says to the extent it has covered customers from SAFU and its treasury, it may be entitled to those customers' rights in the stolen assets, and any recovery will refill those reserves. It offers to indemnify the Arbitrum Foundation, Offchain Labs, and every Security Council member without "any cap, basket, deductible, or limitation." The customers are largely out of the dispute. Binance absorbed their loss, and is now taking on unlimited legal risk to recover a fraction of it.
I found no public filing by North Korea's judgment creditors against Binance's frozen assets as of November 10. The exposure extends beyond Arbitrum, at least in theory. The FBI attributed the theft to North Korea, and the frozen and seized assets total US$2.85 billion. If the creditors' theory survives in court, the same attribution enabling sanctions and law enforcement action could expose those funds to claims from people North Korea has never paid. The Kelp ruling left that question open, and the creditors have already shown they read governance forums.
The theory has a weakness the laundering creates. Funds already handed to Chinese laundering networks may no longer be North Korean property in any sense a court would recognize, and proving otherwise would require evidence the blockchain cannot provide. Attribution names who stole the money. It cannot establish who holds it today.
The incentives run in uncomfortable directions. A stronger attribution helps governments justify sanctions and helps law enforcement seek seizures. Under the creditors' theory, it also strengthens the case for treating stolen funds as North Korean property, potentially at the expense of the institution trying to recover them. As I argued in my analysis of attribution as a confidence judgment, attribution is an intelligence product. In New York, it is becoming evidence in a fight over who gets paid.
Washington Asks for Sanctions While Seoul Waits
The Binance-specific diplomatic response has been rhetorical so far. Responding to Kim Yo Jong's denial, a State Department official said on November 3 North Korea has increasingly relied on cyber crime to evade international sanctions, with cryptocurrency theft and money laundering an important part of the strategy. On November 7, a spokesperson told Yonhap Washington expects all UN member states to enforce existing sanctions, and called coordinated unilateral sanctions a strong tool to stop the flow of money.
The State Department did not say whether it had shared investigative findings with Seoul. South Korea has not begun discussing additional sanctions. A Unification Ministry official said the full circumstances of the theft were not yet established. The Foreign Ministry said it was reviewing measures, including unilateral cyber sanctions, with no decision made, crypto.news reported.
Seoul's caution has a political logic, whatever its operational cost. Unification Minister Chung Dong-young said on November 5 North Korea appeared open to talks with the US if they served its interests. Chung has opposed new sanctions even over a September land mine explosion in the Demilitarized Zone injuring three South Korean soldiers, and sanctions over a theft from a foreign exchange would cut against the engagement he favors.
The cost falls on timing. Elliptic expects the cash-out to run through over-the-counter brokers over months, and designations aimed at those brokers would have to land during that window to matter. My earlier assessment noted the Multilateral Sanctions Monitoring Team estimate of crypto theft supplying roughly one third of North Korea's foreign currency revenue in 2024. The balance still sitting in addresses linked to this single theft exceeds the entire high-confidence North Korean theft total that team counted over 21 months.
Washington has the tools for that window. On November 6, Treasury's Financial Crimes Enforcement Network ordered US financial institutions to stop transmitting funds to or from MEXC Global, citing at least US$16 billion in illicit transactions, including Iranian and North Korean sanctions evasion. The action centers on Iran and Russia and makes no reference to Binance. It still shows Treasury will cut an exchange off from the US financial system when it chooses to.
The cash-out also need not end in Pyongyang. In April 2023, Treasury described a North Korean banker in Dandong directing a China-based over-the-counter trader and a Hong Kong-based trader to send payments to front companies, using funds derived from stolen virtual currency. The front companies then paid suppliers in fiat for goods such as tobacco and communications devices on the regime's behalf.
The conversion still happens, but the money settles with foreign suppliers, and North Korea receives goods rather than currency. Nothing shows the Binance proceeds have entered arrangements like these. The precedent widens the intelligence collection problem from the brokers converting the assets to the suppliers, freight forwarders, and front companies those brokers can pay.
Washington's call carries its own limit. Enforcement of existing UN sanctions depends on member states, including China, where Elliptic traced the suspected over-the-counter cash-out of the Bybit proceeds. A State Department statement asks for that enforcement without the means to compel it.
My earlier assessment closed on a claim about leverage. The code did what it was designed to do, and everything deciding the outcome happened around it. Twelve days later, the claim holds, but the map of leverage has spread wider than the original piece drew it.
Binance's capital restored customer balances, and the executive who managed that capital is leaving. Stablecoin issuers froze a record share of the theft because a record share of the theft was stablecoins. Arbitrum's governance immobilized a slice of the ETH, and a New York precedent now hangs over its release. Polygon's validators are debating whether to rewrite balances to return a few million dollars of POL. The State Department is asking for sanctions, Treasury has shown what it can do to an exchange, and Seoul is not yet ready to act.
None of those levers has touched the roughly US$3.0 billion sitting in addresses linked to the theft, which Elliptic assesses is very likely still in North Korean hands. Courts can rule on those assets, but no ruling moves a bitcoin whose private key sits in Pyongyang, the same limit Washington faces with the IRGC cyber chief it named and cannot touch.
What remains open is a series of decisions by the intermediaries standing between those wallets and anything North Korea wants. An over-the-counter broker, an exchange accepting a deposit, a front company paying a supplier, and the supplier shipping goods can each decide the origin of the money is someone else's problem. The theft is finished. Whether North Korea profits from it will be settled across dozens of those decisions, most of them far from any blockchain, and none of them made yet.