A November 6 update from blockchain intelligence firm Elliptic says approximately $124 million of assets stolen in the October Binance breach had been converted into Bitcoin, including funds originally held as XRP and SOL. The finding is part of an ongoing investigation into the movement of stolen funds attributed by investigators to North Korean-linked actors.
Conversion into Bitcoin
Elliptic reported that by its November 6 checkpoint, analysts had identified about 1,650 BTC held in new addresses following conversion from other stolen assets. The firm said roughly $50 million worth of XRP had begun moving largely towards Bitcoin, while stolen Solana tokens had also been swapped, bridged or mixed.
The investigation describes activity involving tens of thousands of wallets, multiple networks and an assortment of services. Elliptic presented the findings as an ongoing, rapidly changing investigation, and the estimated figure tied to a timestamp should not be treated as a permanent total.
Tracing Across Blockchains
Cross-chain movement complicates tracing because the deposit and payout sides of a transfer may occur on different networks. It can also make the trail harder to follow when funds pass through pools, aggregators and intermediaries. However, the public nature of blockchain transactions and the ability to connect wallet activity through known services can still help investigators reconstruct substantial portions of the flow.
Not the Same as Cashing Out
Elliptic reported that approximately $2.85 billion of the original stolen assets had been frozen and about $3.11 billion remained in addresses linked to the theft at its latest checkpoint. The firm cautioned that only a negligible portion appeared to have been cashed out. Such estimates may change with later tracing, and asset values vary with market prices.
This distinction matters because a criminal actor may hold large amounts of Bitcoin or Ether for some time before attempting to move value through brokers or exchanges. Public addresses can show coins being shuffled, but they generally cannot prove the real-world identity of each subsequent controller or the final ownership arrangement.
The distinction is especially relevant to compliance services. Screening against attributed addresses can alert businesses to potential sanctions or illicit-funds exposure, even when the funds have crossed networks. Yet address blacklists and automated risk scoring are not perfect substitutes for investigation and human judgement.
Separate Security Incident
The evolving theft occurred alongside a different security incident affecting Chainalysis, another blockchain-analysis provider. The two incidents should not be conflated. Chainalysis described its own systems and credentials issue as unrelated to the Binance theft, while Elliptic’s work here concerns tracing funds from that separate exchange incident.
For operators, the lesson connects to custody, counterparty and incident-response themes. Protecting users involves controls over withdrawals, counterparties and incident communications — not simply watching one chain’s transaction explorer.
The next meaningful updates will concern verified freezes, attributed movements to identifiable services and evidence of actual cash-out. Elliptic’s data show the stolen funds are still moving through complex paths. They do not yet tell a complete story about who ultimately receives them or how much can be recovered.
