Hackers behind the $6.43 billion theft from Binance have converted roughly $124 million of the stolen altcoins into Bitcoin, according to a November 6 report from blockchain analytics firm Elliptic. The laundering activity is unfolding at the same time as the exchange restores withdrawal services to its customers.

Converting altcoins, not cashing out

The swaps produced approximately 1,650 BTC, separate from the $1.48 billion taken directly in the October 29 attack. Around $50 million in XRP has been moved so far, while $226 million remains in wallets controlled by the hackers. Nearly all of the stolen Solana — worth about $87 million — has been exchanged for other cryptocurrencies, shifted across blockchains, or routed through transactions designed to obscure its origins.

The latest figures do not provide a complete picture of the stolen funds. Elliptic estimates that $2.85 billion, or 44.3% of the total, has been frozen, while another $3.11 billion, or 48.4%, remains in connected wallets. Together, those categories cover $5.96 billion of the $6.43 billion stolen, leaving roughly $470 million, or 7.3%, unaccounted for in the reported totals. Differences in asset valuations and reporting times may explain the inconsistencies.

The $124 million converted into Bitcoin should not be treated as an additional sum, since the hackers simply traded one crypto form for another rather than cashing out. According to Elliptic, only a small portion of the stolen money has been withdrawn so far. How much of that connected-wallet balance ends up frozen, moved or withdrawn is the figure most likely to change in the updates ahead.

How the laundering keeps moving

The stolen assets have been dispersed across a high volume of transactions. Elliptic's analysis has traced more than 20,000 crypto wallets alongside 16 different blockchains and 65,000 transactions. The activity appears to be automated, although there is no evidence that AI agents are controlling it.

TRM Labs found that the hackers created tokens and liquidity pools on Tron to conceal transfers. They also moved funds through lending receipt tokens and interconnected blockchain bridges, bypassing wallets where assets could be frozen.

Earlier, Chainalysis tracked $325 million in stablecoins being converted into $285 million of Ether within 20 minutes, apparently to avoid freezes. Some XRP conversions passed through THORChain. As Cryptopolitan reported, THORChain's website blocked flagged addresses after an FBI request, but independent nodes continued processing the transactions.

Reopening withdrawals and the liquidity test

Binance is restoring withdrawals while the stolen funds remain in circulation. In a November 6 update also shared on X, the exchange said it aimed to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week. Binance also reported replenishing 98% of the affected token assets by October 31, and it pledged to cover customers' losses — although replacing stolen assets is not the same as recovering them. The six-token target sets the next concrete checkpoint in the exchange's recovery timeline.

The reopening has put Binance's liquidity under pressure. Talos recorded $6.1 billion in net outflows. Bitcoin order-book depth within 1% fell 28% on the first day after the attack and reached a low of roughly 44% below pre-hack levels near November 1 before recovering. Bitcoin itself dropped about 5% following the hack. Talos nevertheless found limited signs of broader market contagion compared with the FTX collapse.

What it means for exchanges and compliance

The FBI attributed the theft to North Korea's TraderTraitor group on October 31. The agency published addresses linked to the hackers and urged THORNode operators, DeFi services and instant exchanges to block related transactions.

Despite the sophisticated laundering, the attack began with familiar security weaknesses. Binance's investigation described a fake job interview, malware installed on an engineer's computer and the misuse of an internal AI tool. The attackers eventually gained access to systems involved in signing wallet transactions.

The breach highlights two challenges for exchanges: protecting employees and sensitive systems from intrusion, and stopping stolen funds from moving across decentralized networks.