Binance attackers swapped $124 million in stolen tokens for bitcoin, Elliptic says

Hackers have swapped $124 million into bitcoin

Attackers in last week's $6.43 billion breach of Binance have swapped about $124 million in stolen altcoins into bitcoin, according to blockchain analysis firm Elliptic.

The breach also involved $1.48 billion in bitcoin stolen directly. The attack is being attributed to North Korea.

Key numbers from Elliptic

• $124 million in altcoins swapped into bitcoin
• More than 20,000 wallets used across 16 blockchains, which are shared digital records of transactions
• 65,000 transactions involved in the laundering operation
• $2.85 billion of the $6.43 billion total has been frozen
• About $3.11 billion, mostly in ether and bitcoin, remains in addresses linked to the attack

How the stolen funds are being moved

Elliptic said the laundering operation is meant to hide the source of the funds. A wallet is a digital account that holds crypto.

Despite the large number of wallets and transactions, Elliptic estimated that only a negligible amount has likely been cashed out so far. That means converted into regular money.

The largest part of the converted bitcoin came from stolen XRP swapped through THORChain. By early Friday, Elliptic said roughly $50 million in XRP had been swapped, mainly into bitcoin, with about $226 million still remaining.

Elliptic also said nearly all of the stolen Solana has already been mixed, swapped, or bridged into bitcoin. Bridging moves funds between different blockchains.

What Elliptic expects next

Elliptic said it expects the attackers to swap the remaining ether for bitcoin in small batches. It said they would then try to cash it out through OTC brokers and Chinese money laundering networks.

Elliptic rejected speculation that AI agents are carrying out the laundering. It said the laundering is clearly automated, but it has seen nothing showing an AI agent making decisions.

Binance plans more withdrawal reopenings

On Friday, Binance said on X that it is working to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week.

Binance also said it aims to reopen withdrawals for all tokens on networks that are already restored, including ETH, BSC, Arbitrum and Optimism.

In its own report published Tuesday, Binance said the attack was carried out over months. It involved a tampered developer tool, a fake job interview, and compromised internal AI tooling that gave the attackers access to Binance's wallet-signing infrastructure.

Binance said it has since replenished virtually all the assets stolen in the breach.

What is still unclear

Elliptic said about $470 million of the $6.43 billion total is not accounted for in its figures. It is unclear whether that is because of price changes since the attack, funds already cashed out, or a mix of both.

Sources

• The Block
• Elliptic

Read also: Binance CFO Kaiser Ng steps down nine days after record hack

Read also: Binance Bitcoin balance rise could be mistaken for selling, Coin Metrics warns

Read also: Binance Hackers Convert $50 Million of Stolen XRP to Bitcoin