Attackers behind the Binance hack have converted $175 million in stolen altcoins into approximately 2,300 BTC, according to blockchain analytics firm Elliptic. The additional bitcoin came from exchanging assets that had already been taken during the October 29 breach of the exchange, meaning the conversions shifted the form of previously stolen funds rather than reflecting a new theft. In other words, the operations change where the funds sit and how difficult they are to trace — not how much was taken.

Elliptic's report, updated on November 7, described extensive transfers across thousands of wallets, multiple blockchains, and dozens of services. The firm's detailed daily account also tracked bitcoin entering coinjoin transactions — privacy tools that combine coins from multiple users and complicate tracing efforts.

Binance Hack Report Tracks $175 Million in Bitcoin Conversions

Elliptic co-founder and chief scientist Tom Robinson characterized the laundering operation as heavily automated. His analysis counted more than 20,000 wallets across 16 blockchains, involving at least 36 services and 65,000 transactions — a pace averaging roughly one new wallet every 30 seconds and one transaction every 10 seconds. Those figures describe aggregate activity rather than proof that artificial intelligence directed the transfers.

Stolen altcoins including SOL, XRP, and TRX contributed to the bitcoin conversions. About $90 million in SOL moved through swaps, bridges, and privacy services — token-to-token exchanges, transfers between blockchains, and tools built to obscure transaction trails — with much of the value eventually becoming bitcoin. THORChain was also involved, facilitating conversions between networks. Ethereum made up a smaller part of the assets converted, while the attackers' primary bitcoin and ether holdings remained dormant.

The November 7 entry said about 88 BTC, valued at $6.7 million, had entered Wasabi-style coinjoins. These transactions combine inputs from multiple participants, making direct links between incoming and outgoing bitcoins more difficult to identify. Robinson also identified about 412,000 NEAR, worth $1.5 million, leaving the main account in small batches. The newly converted 2,300 BTC has been placed in separate bitcoin addresses, distinct from the attackers' existing holdings.

Wallet Totals Differ as Investigators Trace Stolen Funds

A separate tally from analytics platform Arkham shows a much smaller increase than Elliptic's conversion estimate. Arkham's labeled entity reportedly held 18,384.725 BTC at 10 a.m. Eastern on November 7, compared with the 18,270.2 BTC drained during the Binance hack — a difference of roughly 114.525 BTC, well below the 2,300 BTC figure. An Arkham entity page reviewed for this article displayed approximately 18,387 BTC in its labeled wallets, according to news.bitcoin.com.

Those readings do not by themselves reconcile the two platforms. A comparison would require matching addresses, timestamps, and assumptions about which wallets belong to the attackers. Elliptic's figure covers converted stolen altcoins, while Arkham's balance covers addresses grouped under its entity label. Differences in coverage or timing could explain the gap, although the available reports do not establish the cause. Divergences of this kind are a recurring feature of on-chain investigations, since each analytics platform applies its own entity labels and coverage rules to the same underlying addresses.

On-chain records cited in the report show bitcoin deposits from THORChain vaults and TRX swaps through Sun.io, a swap protocol on the TRON network, indicating ongoing laundering activity connected to the hack alongside the dormant primary bitcoin and ether holdings.

Laundering bitcoin remains distinct from cashing out proceeds into spendable funds. Elliptic assessed that only a negligible amount of the stolen assets had likely reached the cash-out stage, despite the extensive transfers between them. Because Elliptic's account is compiled day by day, the November 7 figures are a snapshot of an operation still in motion; the report's subsequent entries, together with published balance trackers such as Arkham's entity page, are the running record to watch as tracing continues.

How the Breach Unfolded and Binance's Response

Attackers drained 18,270.2 BTC from the exchange in the October 29 incident. Investigators determined that they had gained unauthorized access to an internal wallet signing service, and Binance described compromised employee devices and malicious software preceding the unauthorized transfers.

In the aftermath, the exchange said it had closed the identified entry points and rebuilt or replaced affected systems. Its response included tighter device controls and stronger checks on wallet services after the incident.

Binance put the affected assets at approximately $6.34 billion in its November 3 incident report and said it had set aside more than enough funds to absorb the financial impact. The company also cited FBI information attributing the incident to North Korea. It said 98% of impacted token assets had been replenished by October 31, while purchases of remaining illiquid assets continued. Binance reported approximately $2.85 billion in frozen or intercepted assets, subject to reconciliation and changes in market prices.

Source: Blockonomi