Elliptic reported on November 6 that stolen altcoins had yielded about 1,650 BTC. This comes separately from the 18,270 BTC taken directly in the attack. Its investigators traced more than 65,000 transactions involving over 20,000 wallets across 16 blockchains and at least 36 services.
About USD 50 million in XRP had been swapped, mostly into Bitcoin through THORChain, while another USD 226 million remained. The attackers also moved nearly all the stolen Solana, worth about USD 87 million, through swaps, blockchain bridges or mixing services.
Elliptic estimated that USD 3.11 billion remained in addresses linked to the theft, mainly in Bitcoin and Ether. Another USD 2.85 billion had been frozen or seized. The firm said a “negligible amount” had likely been cashed out, distinguishing token swaps from sales for spendable funds.
TRM Labs separately identified newly minted tokens and lending receipt tokens on Tron among the routes used to move stolen funds between wallets. Its analysis also described cross-chain transfers that concealed direct links between some sending and receiving addresses. The firm traced those routes across Tron and Ethereum.
Elliptic also addressed speculation that artificial intelligence was directing the transactions. “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions,” it said. The FBI attributed the October 29 theft to North Korea's TraderTraitor group.
