Binance Hack: Elliptic Says Attackers Turned $175M of Stolen Altcoins Into 2,300 BTC
Elliptic says Binance hack attackers converted $175M of stolen altcoins into 2,300 BTC, but $3.13B of the haul has not moved. What the numbers mean.
Attackers behind the Binance hack have converted about $175 million of stolen altcoins into roughly 2,300 BTC, blockchain analytics firm Elliptic said on Nov. 7. Elliptic traced the laundering across more than 20,000 wallets, 16 blockchains and at least 65,000 transactions.
Social media posts describe it as hackers building a bitcoin fortune. The figure is about 2.7% of the $6.43 billion Elliptic says was stolen on Oct. 29, and most of the haul has not moved.
Summary
- Elliptic says $175 million of stolen altcoins has become about 2,300 BTC, using at least 36 services and roughly one new wallet every 30 seconds.
- About $3.13 billion remains in theft-linked addresses, mostly BTC and ETH, while $2.85 billion has been frozen or seized.
- A negligible amount has likely been cashed out, and the unmoved funds are very likely still held by North Korea, Elliptic said.
- The laundering is automated, but Elliptic has seen no sign that an AI agent is making decisions.
How altcoins became bitcoin
Elliptic’s co-founder and chief scientist, Tom Robinson, described the laundering as “highly complex and clearly automated.” It has produced about one transaction every 10 seconds since the theft.
All of the stolen Solana, about $90 million, has been swapped, bridged or mixed, and much of it ended up as bitcoin. Some batches crossed four blockchains in a few hours. The conversion has since spread to XRP. About $100 million of it has been swapped, mostly into bitcoin through the THORChain bridge, and about 148 million XRP ($173 million) remains. Most of the early laundering ran through Tron, where about $230 million in TRX moved.
Elliptic also tracked smaller flows, including about 412,000 NEAR ($1.5 million) leaving the main account in small batches overnight.
🔥 Binance hackers are turning stolen crypto into a bitcoin fortune! Elliptic says $175M converted into 2,300 BTC, 20,000 wallets and 65,000 transactions. The plot thickens. https://t.co/DEVKc9aBMC
— Bitcoin.com News (@BitcoinNews) November 7, 2026
Most of the haul has not moved
The 18,270 BTC taken directly in the attack sits in 19 addresses and has not moved since Oct. 29. Only $3 million of the $1.34 billion in ETH has moved. Together with other unmoved assets, that leaves about $3.13 billion in addresses linked to the theft. Elliptic said these funds are very likely still held by North Korea. The FBI attributed the theft to its TraderTraitor group on Oct. 31, and Pyongyang has denied it.
Another $2.85 billion, or 44% of the haul, has been frozen or seized, mostly stablecoins. Tether froze the stolen USDT 37 minutes after it arrived on Ethereum, and Circle froze all 823 million stolen USDC before any of it was swapped, according to Elliptic. Binance puts the total loss at $6.34 billion, slightly below Elliptic’s $6.43 billion estimate.
Elliptic said a negligible amount has likely been cashed out. Converting one asset to another is not the same as spending it. To reach real money, the attackers need exchanges or over-the-counter brokers, which is where funds can still be identified and stopped.
Mixers and privacy pools add cover
About 88 BTC ($6.7 million) has gone through Wasabi-style coinjoins, which combine many users’ coins so the link between inputs and outputs is hidden. Since Nov. 3, about $6.7 million in ETH and SOL has also been deposited into Privacy Cash, a privacy pool on Ethereum and Solana. Privacy Cash paused deposits for about a day after the Binance hack while it strengthened its wallet screening.
You might also like: Did Ethereum EIP-7702 cause the Binance hack? What security experts say
Wallet trackers show different numbers
Arkham Intelligence data showed the hacker-associated address holding 18,384.7 BTC at 10 a.m. ET on Nov. 7, without the added 2,300 BTC, ChainCatcher reported. Blockonomi explained that the two figures measure different things. Elliptic counts converted altcoins that landed in newly created bitcoin addresses, while Arkham’s balance covers the addresses it groups under one entity label. Neither contradicts the other.
Automated, but no AI agent found
The speed of the laundering has led to speculation that AI agents are moving the money. Elliptic points to conventional automation instead: fixed timing, set amounts, blind retries and new tactics added hours apart. It saw pauses that look like human working patterns, and nothing showing an AI agent making decisions.
What happens next
After the Bybit hack in February 2025, North Korea laundered all 499,000 stolen ETH within ten days, but cashing out took months through suspected Chinese over-the-counter services, Elliptic said. The Binance laundering is slower so far. ETH and BTC cannot be frozen, so there is less urgency, the sums are more than twice those stolen from Bybit, and the FBI has published the attacker’s addresses, so services are watching.
Elliptic expects the ETH to be swapped for bitcoin in many small transactions and cashed out over months. Further freezes will be harder. About 3% of the Bybit haul was frozen, against 44% here, and the best remaining chances are stablecoins caught in transit and exchanges at the point of cash-out.
What to watch next
- Whether the 18,270 BTC or the $1.34 billion in ETH starts to move.
- How fast the remaining 148 million XRP is converted.
- Any new freezes by exchanges, bridges or stablecoin issuers.
- Binance’s promised post-mortem and independent review.
Read more: Binance says 98% of hacked assets are replaced. Here is what that number covers
Figures come from Elliptic and other sources named above and change as funds move. This article is for information only.
