Elliptic: Binance hackers have swapped $124M of stolen altcoins into bitcoin, little cashed out so far

Attackers behind last week's $6.43 billion breach of Binance have converted roughly $124 million in stolen altcoins into bitcoin, according to an update from blockchain analytics firm Elliptic, reported by The Block on November 6. That $124 million is on top of the $1.48 billion in bitcoin taken directly in the attack, which Elliptic attributes to North Korea.

Per Elliptic, the laundering has so far run through more than 20,000 wallets, 16 blockchains and 65,000 transactions — but the firm estimates only a "negligible amount" has actually been cashed out. The largest chunk of converted bitcoin came from stolen XRP routed through THORChain: Elliptic says about $50 million in XRP had been swapped, mostly into bitcoin, by early Friday, with roughly $226 million in XRP still to go. Nearly all the stolen Solana has already been mixed, swapped or bridged into bitcoin, the firm said.

Elliptic's accounting leaves gaps it doesn't fully resolve. Around $3.11 billion — mostly ether and bitcoin — still sits in addresses tied to the attack, and $2.85 billion of the $6.43 billion total has been frozen. That leaves about $470 million unaccounted for; Elliptic says it's unclear whether that's down to price moves since the attack, funds already cashed out, or a mix. The firm expects the attackers to swap remaining ether into bitcoin in small batches before trying to offload it through OTC brokers and Chinese money-laundering networks. It also explicitly rejected speculation that AI agents are running the operation: "The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions."

Separately, Binance said on X on Friday it aims to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the "end of next week," plus all tokens on already-restored networks including ETH, BSC, Arbitrum and Optimism. Binance's own incident report, published Tuesday, said the breach was carried out over months via a tampered developer tool, a fake job interview and compromised internal AI tooling that reached its wallet-signing infrastructure. The exchange says it has replenished virtually all stolen assets.

Key facts

• $124M in stolen altcoins swapped into bitcoin, on top of $1.48B BTC stolen directly — Elliptic, via The Block.
• Laundering spans 20,000+ wallets, 16 blockchains, 65,000 transactions; "negligible amount" cashed out — Elliptic.
• ~$50M XRP swapped (mostly to BTC), ~$226M remaining; nearly all stolen SOL already moved — Elliptic.
• $3.11B still in attacker-linked addresses; $2.85B frozen; ~$470M unaccounted for — Elliptic.
• Total breach $6.43B, attributed to North Korea — Elliptic/The Block.
• Withdrawals for HYPE, INJ, APT, PLASMA, NEAR, LTC targeted to reopen by end of next week — Binance on X.

The real-world read

The headline figures come from Elliptic, a vendor whose business is tracing exactly this kind of flow — credible, but note that the ~$470 million hole in its own tally is unexplained, so treat the totals as an estimate, not a reconciled ledger. The "negligible amount cashed out" line is reassuring but unfalsifiable from the outside; what's confirmed is movement, not recovery. Binance's reassurances — the attack narrative and the "replenished virtually all assets" claim — come from Binance's own report and X account, an interested party with every reason to project control; its withdrawal-reopening dates are stated goals, not guarantees. Elliptic's flat denial that AI agents are driving the laundering is worth flagging precisely because someone was floating the opposite.

Opinion, and whose

Elliptic forecasts that the attackers will convert remaining ether to bitcoin in small batches and cash out via OTC brokers and Chinese money-laundering networks — its projection, not an established fact. The North Korea attribution is Elliptic's assessment.

This is news coverage, not financial advice.