Hackers behind the $6.3 billion Binance breach have converted $175 million in stolen altcoins into approximately 2,300 BTC, according to blockchain analytics firm Elliptic. The conversion adds to the 18,270.2 BTC originally drained from the exchange in what Elliptic describes as the largest cryptocurrency exchange hack in U.S. dollar terms.
Laundering Operation Spanning Multiple Blockchains
Elliptic co-founder and chief scientist Dr. Tom Robinson published an analysis incorporating updates through Saturday, Nov. 7, 2026. According to the report, the stolen altcoins were swapped into bitcoin through a highly complex and automated process that has used more than 20,000 wallets across 16 blockchains, at least 36 services, and at least 65,000 transactions.
Robinson characterized the scale of the operation as roughly one new wallet every 30 seconds and one transaction every 10 seconds.
The report states that approximately $90 million in stolen solana (SOL) was transferred, with much of the proceeds ultimately converted into bitcoin. XRP and tron (TRX) also contributed to the attackers' expanding bitcoin holdings, while ethereum (ETH) accounted for a smaller portion of the conversions. Thorchain was used to facilitate cross-chain asset swaps.
Obfuscation Techniques and Dormant Holdings
A portion of the newly acquired bitcoin subsequently flowed through Wasabi Wallet coinjoins, a technique that commingles bitcoin from multiple participants to complicate blockchain tracing. By Nov. 7, approximately 88 BTC, valued at $6.7 million, had been processed through this method, according to Robinson's analysis.
On the NEAR blockchain, approximately 412,000 NEAR ($1.5 million) left the main accounts in small batches. Robinson noted that roughly 2,300 BTC ($175 million) now sit in newly created bitcoin addresses following conversions from other stolen cryptocurrencies, while the primary bitcoin and ethereum holdings remain untouched.
Robinson's analysis repeatedly ties the hackers to North Korea, mentioning the country eight times.
Arkham Data Shows Slightly Different Picture
Data from blockchain analytics platform Arkham Intelligence, gathered by Bitcoin.com News, shows no corresponding addition of 2,300 BTC, though the original 18,270.2 BTC attributed to the attackers had climbed to 18,384.725 BTC as of 10 a.m. ET on Nov. 7, 2026.
Arkham's transaction records nevertheless reveal bitcoin deposits originating from Thorchain vaults on Saturday, alongside TRX token swaps executed through Sun.io, a decentralized finance protocol operating on the Tron network.
