Attackers behind the Binance hack converted $175 million in stolen altcoins into approximately 2,300 BTC, according to blockchain analytics firm Elliptic. The bitcoin came from exchanging assets already taken during the October 29 exchange breach, Elliptic reported in an update dated November 7.
Extensive Laundering Operation
Elliptic co-founder and chief scientist Tom Robinson described the operation as heavily automated. The analysis counted more than 20,000 wallets across 16 blockchains, involving at least 36 services and 65,000 transactions. Activity averaged roughly one new wallet every 30 seconds and one transaction every 10 seconds, though those figures describe aggregate activity rather than proof that artificial intelligence directed the transfers.
Stolen altcoins, including SOL, XRP, and TRX, contributed to the bitcoin conversions. About $90 million in SOL moved through swaps, bridges, and privacy services, with much of the value eventually becoming bitcoin. THORChain facilitated conversions between networks. Ethereum made up a smaller part of the converted assets, while the primary bitcoin and ether holdings remained stationary.
Coinjoins and NEAR Transfers
The November 7 entry said about 88 BTC, valued at $6.7 million, had entered Wasabi-style coinjoins. These transactions combine inputs from multiple participants, making direct links between incoming and outgoing bitcoins more difficult to identify. Robinson also identified about 412,000 NEAR, worth $1.5 million, leaving the main account in small batches. The newly converted 2,300 BTC were placed in separate bitcoin addresses.
Wallet Totals Diverge
Arkham’s labeled entity showed 18,384.725 BTC at 10 a.m. Eastern on November 7, compared with the 18,270.2 BTC drained during the Binance hack. The difference was roughly 114.525 BTC, well below Elliptic’s 2,300 BTC conversion estimate. Arkham’s entity page reviewed for this article displayed approximately 18,387 BTC in its labeled wallets.
Those readings do not by themselves reconcile the two platforms. A comparison would require matching addresses, timestamps, and assumptions about which wallets belong to the attackers. Elliptic’s figure covers converted stolen altcoins, while Arkham’s balance covers addresses grouped under its entity label. Differences in coverage or timing could explain the gap, although the available reports do not establish the cause.
Records also show bitcoin deposits from THORChain vaults and TRX swaps through Sun.io, indicating ongoing activity connected to the Binance hack alongside the dormant primary bitcoin holdings. Elliptic assessed that only a negligible amount had likely reached the stage of being cashed out into spendable funds, despite extensive transfers between assets.
Binance Response and Attribution
Investigators identified unauthorized access to an internal wallet signing service. Binance described compromised employee devices and malicious software preceding the unauthorized transfers. The exchange said it had closed the identified entry points and rebuilt or replaced affected systems, including tighter device controls and stronger checks on wallet services.
Binance put the affected assets at approximately $6.34 billion in its November 3 incident report and said it had set aside more than enough funds to absorb the financial impact. The company cited FBI information attributing the incident to North Korea. It said 98% of impacted token assets had been replenished by October 31, while purchases of remaining illiquid assets continued. Binance also reported approximately $2.85 billion in frozen or intercepted assets, subject to reconciliation and changes in market prices.
