The coinjoin is not the pile.
@elliptic posted at 11:09 UTC on November 2 that the first mixing had started, about 28 BTC, $2.2 million, run through Wasabi-style coinjoins. https://x.com/elliptic/status/2117212613553602691. When I read it, that post had 21 likes, 7 reposts, 3 replies, 2 quotes, 13 bookmarks, and 2,253 impressions. The same post lists about 12,000 wallets on 11 blockchains, more than 40,000 transactions in under four days, $3.24 billion still in linked addresses, and $2.85 billion frozen. The mix is the third line.
@WuBlockchain posted 36 minutes later, and that is the one that traveled. https://x.com/WuBlockchain/status/2117221564827746502. When I read it, 160 likes, 27 reposts, 36 replies, 9 quotes, 41 bookmarks, and 25,016 impressions. The headline pairs CoinJoin with 44% frozen. The body I got lists 11 blockchains, about 12,000 wallets, and more than 40,000 transactions, then cuts off at 44% on the photo. Those two figures are not the same coins. I wrote on October 30 that the freeze is not a return. I am not redoing that one.
What the page counts
The note is by Tom Robinson. Last updated 08:40 UTC on November 3. https://www.elliptic.co/insights/how-north-korea-is-laundering-the-6-4-billion-stolen-from-binance. He writes that the funds are moving fast, and that the description may not be complete. When the page says the attacker, it means whoever controls the wallets holding the funds now. The chain shows the wallets. It does not show the person.
The theft figure on the page is $6.43 billion, taken from 20:05 to 23:56 UTC on October 29, across 11 blockchains. $2.85 billion is frozen or seized. Around $3.18 billion remains in addresses linked to the theft, mostly ETH and BTC. The November 2 post said $3.24 billion. I am leaving both up. They are a day apart, and the page says the situation is still moving.
The mix has a clock. From 05:55 UTC on November 1, bitcoin that came from the Tron funds went into coinjoins using WabiSabi, the protocol used by Wasabi Wallet and similar wallets. Later that day some parked ETH was swapped for bitcoin, and most of that went the same way. By 06:02 UTC on November 2, about 28 BTC, $2.2 million, had been put through 18 coinjoins. The caption under the diagram says those joins had between 101 and 491 inputs each.
The bitcoin taken as bitcoin is a different sentence. The page says that in the same half hour, the 18,270 stolen BTC was split into 19 addresses, and that it has not moved since. That is the pile. 28 is not 18,270. I have not opened the 19 addresses. I am using their count, and I am not going to pretend I watched the split.
The November 3 section is another number, and I am not folding it into the mix. By 08:40 UTC that morning, about 200 BTC, $15 million, sat in new bitcoin addresses, converted from other stolen assets. The key points, on a page updated at that same time, still list the mix at 28 BTC. A swap into a new address is not a coinjoin. I do not have a later mix total. I am not writing one.
Who else is in the transaction
Elliptic’s sentence is plain. A coinjoin combines many users’ bitcoin in a single transaction, which breaks the visible link between the coins going in and those coming out. That is what the tool is for. I am not arguing with the sentence.
The inputs stay on the transaction. 101 to 491 of them, on the joins they counted. I have not opened those transactions. I am not going to name the other inputs from a caption. Funds the page ties to the theft went in next to other people’s bitcoin. The other inputs did not choose who else was in the transaction.
Breaking the output link does not delete the input list. A tracer who already has the stolen input can see that it joined. The outputs get harder to map back. The co-inputs do not get hidden. They are in the same transaction, next to one a tracing firm has already written up.
I am not saying those other coins are stolen. The transaction is public, and the label on one input is public with it. $2.2 million is small next to $6.43 billion. A join with a few hundred inputs is not small for the people in it. One labeled input puts their coins in the same public transaction.
Wasabi-style is their phrase. I did not read the wallet docs this morning, and I am not going to describe a coordination round I did not open. WabiSabi is the protocol name on the page. 18 is the count they published. 101 and 491 are the ends of the range in the caption.
The headline paired the freeze
44% is the frozen pile. On this page, $2.85 billion of $6.43 billion. Elliptic has said almost all of what stopped is money an issuer could freeze. That was the October 30 note. The coinjoin figure is $2.2 million of bitcoin that came off Tron funds and, later, off some parked ETH. It is not 44% of the theft. It is not the 18,270 BTC that has not moved.
The post with 25,016 impressions is the one that puts CoinJoin and 44% in the same headline. Elliptic’s own post, the one that actually prints $2.2 million, had 2,253. The page does not make that pairing. The headline does.
$3.18 billion still sits in linked addresses, on the November 3 update. Most of that, the page says, has not been laundered yet. The bitcoin, and the ETH in the nine largest addresses. The page says those unmoved funds are very likely still held by North Korea, and that the funds already being laundered may already be with someone else. I cannot check a person from a wallet. I can read the sentence next to 18,270 BTC. It has not moved since the split.
Cashing out is a later step, and it is not this note. The page says a negligible amount has likely been cashed out. Turning the rest into money someone can spend needs a counterparty, an exchange or an over-the-counter broker. That is their expectation from the Bybit case. I am not adopting the timetable.
The 28 BTC is the part that entered a join. The 18,270 BTC taken as bitcoin has not. If you were in one of those 18 transactions, your input is in a public list next to funds this page ties to the theft. I read the page. I did not open the joins.