Elliptic put assets remaining in linked addresses at about $3.24 billion, mostly $ETH and $BTC, alongside $2.85 billion frozen or seized. Those balances reflect prices at about 2 a.m. ET on Nov. 2; its $6.43 billion estimate of the original theft uses values at the time the assets were stolen.
Loading post from X…
View post on X
From Bridges to Bitcoin Mixing
The mixing adds another obstacle to the bridge routes out of Tron covered in The Defiant's earlier reporting. Bridges transfer value between blockchains. Coinjoins instead combine several users' bitcoin into a single transaction, making it harder to match incoming coins to their owners' new outputs, as Wasabi's documentation explains.
Elliptic said the bitcoin entering coinjoins came first from the Tron funds, followed by bitcoin obtained by swapping some parked $ETH. The 18,270 $BTC taken directly in the theft had been split among 19 addresses and had not moved since, it said.
Elliptic's assessment points to software scripts rather than evidence of AI-directed laundering. The firm described the activity as “running on conventional automation” in its X update. Its analysis cited fixed timing, set amounts and blind retries.
The FBI attributed the theft to North Korea's TraderTraitor activity on Oct. 31 and urged crypto businesses and infrastructure operators to block transactions involving the listed addresses or funds derived from them.
Mixing does not itself turn the proceeds into spendable cash. Elliptic estimated that a negligible amount had likely been cashed out. With native bitcoin and $ETH outside token issuers' freeze controls, the firm identified stablecoins briefly held in transit and centralized services used to cash out as the best remaining opportunities to stop the funds.
thedefiant.io
