The funds were taken across 11 blockchains, and Binance has said the attack began with a compromised engineer's laptop.
The FBI attributed the theft to TraderTraitor, a North Korea-linked group, and published the attacker's addresses.
In under four days, the funds passed through about 12,000 wallets and more than 40,000 transactions, and Elliptic describes the process as highly complex and clearly automated.
Tether and Circle, which issue the USDT and USDC stablecoins, can freeze them, so the attacker first rushed to swap them for assets that cannot be frozen, such as ETH and TRX.
Circle froze all 823 million stolen USDC before any was swapped, and Tether froze USDT on Ethereum 37 minutes after it arrived.
Even so, about $786 million of stablecoins was converted first.
Elliptic says freezing 44% of the stolen funds is unusual, compared with around 3% after the Bybit hack in February 2025.
Roughly $3.24 billion remains in addresses linked to the theft, mostly bitcoin and ETH in the nine largest addresses, which Elliptic believes North Korea still holds.
The laundering is also slower than it was after Bybit, when North Korea moved all 499,000 stolen ETH within ten days. Elliptic cites several reasons: ETH and BTC cannot be frozen, the sums are more than double Bybit's, rapid swaps would cause large losses, and published addresses mean services are watching. Most activity ran through Tron, where funds were split across about 7,700 addresses and bridged to Ethereum. Since November 1, about 28 BTC ($2.2 million) has gone through Wasabi-style coinjoins, which pool many users' coins to break the visible link between inputs and outputs. Elliptic expects ETH to be swapped for bitcoin in small transactions and cashed out through over-the-counter brokers over months. Because cash-out requires a counterparty, such as an exchange or broker, it is where the funds are most likely to be identified and stopped. Elliptic also warns that fake tokens sent from look-alike addresses are address-poisoning scams not controlled by the attacker.
