On 29 October 2026 hackers the FBI names as North Korea's TraderTraitor drained Binance's hot wallets in under four hours. Step through how the money moved, what got frozen, and where it sits now. New to mixers? See how Tornado Cash works.
Elliptic figures as of 2 November 2026, against its total of $6.43B. "Moved on" is what is left after the other two are subtracted. Elliptic says very little has been cashed out so far. The 18,270 BTC taken directly still sits in 19 addresses.
Checking all 628 wallets on the blockchain…
Checked straight from the blockchain in your browser, using public Ethereum, Bitcoin and Solana nodes and Coinbase prices. Native coins only. Refreshes every 10 minutes.
Value at the time of the theft, from TRM Labs (total ≈$6.36B). Operator wallet named by Arkham: 0x7C8601d4645b93cea45F71e118A729332e6B5CA0. The FBI's full list of 628 addresses is on the hack board.
Sources: TRM Labs, Elliptic, crypto.news on Elliptic's CoinJoin count, SBS citing Chainalysis and Lookonchain, Wikipedia timeline. Figures move daily; this page shows the picture as of 2 November 2026.