Attackers behind the October 29 Binance security breach have converted approximately $175 million in stolen altcoins into around 2,300 BTC, according to blockchain analytics firm Elliptic. The conversions represent an additional stage in the movement of funds taken during the incident, with investigators identifying transfers across thousands of wallets, multiple blockchain networks and dozens of cryptocurrency services.
In its report updated November 7, Elliptic detailed an extensive laundering operation involving more than 20,000 wallets across 16 blockchains, at least 36 services and approximately 65,000 transactions. The scale and pace of activity suggest a highly automated process designed to distribute stolen assets, move value between networks and complicate blockchain tracing.
Elliptic co-founder and chief scientist Tom Robinson described the operation as heavily automated. According to his analysis, the network generated approximately one new wallet every 30 seconds and processed one transaction every 10 seconds. These figures highlight the operational scale of the transfers, although they do not independently establish the use of artificial intelligence to coordinate the activity.
The conversion of stolen altcoins into Bitcoin is particularly relevant because it represents a shift in the assets being used to hold the proceeds. Tokens including Solana (SOL), XRP and TRX were moved through swaps, cross-chain bridges and privacy-related services before being converted into Bitcoin.
Solana accounted for a substantial portion of the activity, with approximately $90 million in SOL passing through various conversion routes. Much of that value eventually became Bitcoin, while THORChain facilitated exchanges between blockchain networks.
Ethereum represented a smaller share of the converted assets. Elliptic also reported that the primary Bitcoin and Ether holdings associated with the attackers remained stationary, distinguishing the movement of newly converted funds from the original holdings taken during the breach.
The use of multiple conversion routes creates additional complexity for investigators. Cross-chain swaps separate the movement of assets from their original networks, while the distribution of funds across numerous addresses makes it more difficult to establish a continuous transaction history. However, the underlying blockchain transactions remain publicly observable, allowing analytics firms to track activity through address relationships and transaction patterns.
Privacy-enhancing transactions have also become part of the operation. Elliptic's November 7 update identified approximately 88 BTC, worth around $6.7 million at the time, entering Wasabi-style coinjoins.
Coinjoins combine Bitcoin inputs from multiple participants into coordinated transactions, making it harder to determine which outgoing funds correspond to specific incoming deposits. Their use introduces another layer of complexity into the investigation, particularly when combined with transfers across different services and blockchain networks.
The report also identified approximately 412,000 NEAR tokens, valued at around $1.5 million, leaving the main account in smaller batches. The newly converted 2,300 BTC were distributed across separate Bitcoin addresses rather than being held in a single wallet.
Differences between blockchain intelligence platforms have added another dimension to the investigation. At 10 a.m. Eastern on November 7, an Arkham-labeled entity associated with the attackers reportedly held approximately 18,384.725 BTC, compared with the 18,270.2 BTC initially drained during the breach. A subsequent reading of Arkham's entity page showed approximately 18,387 BTC.
The difference between the initial drained balance and the reported entity holdings is approximately 114.525 BTC, considerably smaller than Elliptic's estimate of 2,300 BTC in additional Bitcoin conversions.
However, the figures measure different things and should not be treated as directly interchangeable. Elliptic's estimate concerns stolen altcoins converted into Bitcoin, whereas Arkham's balance reflects Bitcoin held in addresses grouped under its entity classification. Differences in address coverage, attribution methods and reporting timestamps could contribute to the discrepancy, but the available figures do not establish a definitive reconciliation.
Additional transactions involving THORChain vaults and TRX swaps through Sun.io indicate that activity connected to the stolen funds continued beyond the initial asset conversions. This suggests that the laundering process remains operational, even as the primary Bitcoin holdings have remained largely stationary.
Importantly, converting stolen assets into Bitcoin does not necessarily mean the attackers have successfully realized their value. Moving funds between blockchains and wallets is different from converting them into spendable fiat currency or otherwise accessing their economic value. Elliptic assessed that only a negligible portion of the proceeds had likely reached that stage.
That distinction is central to understanding the scale of the incident. The movement of approximately $175 million into Bitcoin demonstrates that a substantial amount of the stolen altcoins has been successfully repositioned. It does not establish that the attackers have liquidated those holdings or converted them into usable proceeds.
The original breach involved unauthorized access to an internal Binance wallet-signing service. Binance attributed the incident to compromised employee devices and malicious software that preceded the unauthorized transfers.
The exchange said it had closed the identified entry points and rebuilt or replaced affected systems, introducing tighter device controls and additional safeguards around wallet services.
Binance valued the affected assets at approximately $6.34 billion in its November 3 incident report and said it had sufficient financial resources to absorb the impact. The exchange also cited FBI information attributing the incident to North Korea.
According to Binance, 98% of the impacted token assets had been replenished by October 31, while efforts to acquire the remaining illiquid assets continued. The company also reported approximately $2.85 billion in frozen or intercepted assets, although that figure remains subject to reconciliation and changes in market prices.
For Bitcoin markets, the immediate significance is not necessarily the reported conversion amount itself, but the potential implications of how and when the newly accumulated BTC might eventually move. The separation of funds across multiple addresses and the use of coinjoins could complicate attribution, while continued transfers through cross-chain services provide investigators with additional activity to monitor.
The next important developments will be whether the approximately 2,300 BTC begin moving toward identifiable exchanges or other conversion services, whether additional altcoin holdings are transferred into Bitcoin, and whether blockchain investigators can establish clearer links between the newly created addresses and the original stolen funds.
Until evidence of further liquidation emerges, the reported conversions should primarily be understood as a change in the composition and distribution of the stolen assets rather than confirmation that the attackers have successfully cashed out.
Avalanche
Ethereum
