The Money Did Not Vanish: Following Stolen Funds as They Change Form

A new snapshot of the funds’ movements

In its November 4 update, Elliptic describes around 12,000 wallets and more than 40,000 transactions during the first three and a half days after the attack. The company also reports significant movements of SOL on November 3–4. The earlier picture of large balances simply sitting untouched therefore no longer describes every branch of the funds’ movements. These are analysts’ observations at a particular moment, not a final accounting of the investigation.

TRM Labs highlights the difficulty of tracing the flows themselves. Value can move between addresses through swaps, liquidity pools and tokens representing claims on deposited assets. Looking only at transfers of one original token can leave some connections unseen. The absence of a direct transfer between two wallets does not necessarily mean there is no economic connection.

An address is not a name

Visibility into the movement of funds does not, however, establish the identity of every person behind the addresses. The FBI officially attributed the attack to North Korea and the activity it calls TraderTraitor. Its October 31 notice contains no names of the individuals who carried out the attack or announcement of their arrests.

Nor should we rush to imagine an autonomous ‘AI hacker’. Elliptic considers the movement of funds clearly automated, but sees no evidence in the observed data that an AI agent is making the decisions.

Three different events

In covering this part of the investigation, we will distinguish three events: funds being located, control over them being restricted, and funds being returned. A report of one does not allow us to fill in the other two.