Hackers who drained billions from Binance have converted roughly $175 million worth of stolen altcoins into about 2,300 bitcoin, according to blockchain analytics firm Elliptic, as the exchange continues restoring services in the wake of the largest crypto theft on record.
The conversions trace back to the October 29 breach, in which attackers moved approximately $6.34 billion in customer assets out of the exchange. Elliptic's account, updated November 7, describes a laundering operation that has spread value across thousands of wallets and more than a dozen blockchains, with the proceeds repeatedly swapped and bridged before settling into bitcoin.
Tom Robinson, Elliptic's co-founder and chief scientist, characterized the operation as heavily automated. His analysis counted more than 20,000 wallets across 16 blockchains, touching at least 36 services and roughly 65,000 transactions. That works out to about one new wallet every 30 seconds and one transaction every 10 seconds.
Those figures describe the scale of the activity, not proof that artificial intelligence is directing it. "The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," the firm said, pushing back on speculation that autonomous software is running the campaign.
Stolen solana, XRP and tron tokens have fed the bitcoin conversions. About $90 million of the SOL moved through swaps, bridges and privacy services, with much of the value ultimately becoming bitcoin. Cross-chain protocol THORChain has been a key conduit, handling direct conversions between networks. Ether made up a smaller share of the converted assets, while the largest bitcoin and ether holdings remain untouched.
Elliptic tracked at least 88 BTC, valued at $6.7 million, entering Wasabi-style coinjoin services, which blend inputs from multiple users to obscure the link between incoming and outgoing coins. Robinson also identified about 412,000 NEAR, worth $1.5 million, leaving the main account in several smaller batches. The newly swapped bitcoin sits in separate addresses, distinct from the consolidated balances drained in the initial hack.
The latest figure is an increase from earlier tallies. Elliptic reported November 6 that about $124 million had been converted into roughly 1,650 BTC, including $50 million in XRP routed mostly through THORChain. Roughly 192 million XRP, worth an estimated $226 million, remained unswapped at that point.
Note: Figures reflect Elliptic's November 7 update and may shift as asset prices and tracing progress change.
The strategy appears shaped by what can and cannot be frozen. Stablecoin issuers Tether and Circle locked affected balances within an hour of the theft, pushing the attackers toward assets such as XRP and bitcoin that no central authority can block. Nearly all of the stolen solana, about $87 million, has been swapped, bridged or mixed, and most of the roughly $220 million in tron tokens has been laundered, much of it bridged to Ethereum.
Wallet balances reported by different trackers do not line up neatly. Arkham showed 18,384.725 BTC tied to the attackers as of 10 a.m. Eastern on November 7, against the 18,270.2 BTC taken in the breach, a gap of about 114.5 BTC. That is far below Elliptic's 2,300 BTC conversion estimate. The two sets measure different things: Elliptic counts converted stolen altcoins, while Arkham's figure reflects labeled addresses at a moment in time. Reconciling them would require matching addresses, timestamps and assumptions about wallet control, which the available reports do not provide.
Both firms continue to log activity, including bitcoin arriving from THORChain vaults and tron swaps routed through Sun.io. Even so, Elliptic assesses that only a negligible slice of the haul has reached spendable currency. Most of it is cycling between digital assets or sitting dormant. The firm expects the attackers to eventually convert ether into bitcoin and cash out through over-the-counter brokers and exchanges over a period of months, noting that after the 2025 Bybit hack, North Korea laundered all 499,000 stolen ether within 10 days but took months to convert it to fiat.
Binance has said the breach stemmed from unauthorized access to an internal service used to authorize wallet transactions, traced to compromised employee devices infected with malicious software before the withdrawals. The exchange said it closed the entry points and rebuilt or replaced affected systems, adding tighter device controls and stronger validation of wallet transactions.
In its November 3 incident report, Binance put losses at $6.34 billion and said reserves set aside were more than sufficient to absorb the hit. The exchange credited the FBI with information linking the operation to North Korea, and said it had replenished 98% of affected token balances by the end of October. It reported freezing or intercepting about $2.85 billion in digital assets, a figure that moves with market prices, and said it is still buying up remaining illiquid assets to make customers whole.
Withdrawals have been coming back online in stages. Binance said it aimed to reopen withdrawals for tokens including HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week, and that users could verify 1:1 backing of balances through a zero-knowledge proof in its latest proof-of-reserves snapshot.
The episode has also tested exchange liquidity. Talos recorded $6.1 billion in net outflows, while bitcoin order-book depth within 1% fell 28% on the first day and at one point sat roughly 44% below pre-hack levels before recovering. Bitcoin dropped about 5% after the attack, though the firm found limited signs of contagion beyond Binance compared with the FTX collapse.
For the market, the open question is how much of the remaining XRP and ether will be swapped into bitcoin and whether the attackers can eventually convert those holdings into fiat. Investigators and node operators are watching whether bridges such as THORChain can keep blocking flagged addresses quickly enough to slow the conversions. Exchange operators, meanwhile, face the same two problems the breach exposed: keeping employees and signing systems out of reach of intruders, and limiting how easily stolen funds can move across decentralized networks.
