Elliptic Traces 124 Million in Binance Hack Proceeds Converted to 1650 BTC as 3.11 Billion Remains in Linked Wallets

The conversion of $124 million into Bitcoin reveals that even amid $2.85 billion in stablecoin freezes, automated multi-chain protocols still allow attackers to bypass centralized choke points and consolidate value into unfreezable base-layer assets.

• The conversion into Bitcoin: Blockchain analytics firm Elliptic confirmed that roughly $124 million of diverse assets stolen in the October 29 Binance breach has been funneled into approximately 1,650 BTC as of November 6, 2026.
• The automated laundering path: Threat actors routed assets—primarily $50 million in XRP and nearly all stolen SOL—across more than 20,000 wallets on 16 blockchains via 36 cross-chain swap services like THORChain, bridges, and mixers across 65,000 transactions.
• The locked versus liquid funds: Of the $6.43 billion stolen by the FBI-designated TraderTraitor group, $2.85 billion in stablecoins was frozen by Tether and Circle, while $3.11 billion remains static in linked addresses, leaving only a negligible portion successfully cashed out.

• The original breach scale: The October 29 incident resulted in $6.43 billion extracted across 11 blockchains, making it the largest recorded digital asset theft in history and directly attributed by the FBI and Elliptic to North Korean-linked actors.
• The split in asset mobility: Attackers left 18,270 directly stolen BTC unmoved in 19 addresses, prioritizing the conversion of high-friction alternative layer-1 tokens into Bitcoin while stablecoin issuers locked centralized assets.
• Exchange operational response: Binance initiated a phased reopening of deposit and withdrawal pipelines across affected networks, even as the perpetrators continued their automated token redistribution.

The operational blueprint behind laundering $6.43 billion is not about immediate monetization; it is an exercise in asset consolidation under extreme surveillance. When the TraderTraitor group breached Binance, they acquired a fragmented portfolio across multiple blockchains. Their immediate structural dilemma was liquidity decay: centralized issuers can freeze fiat-backed tokens instantly, whereas permissionless base-layer protocols cannot execute unilateral balance freezes.

Centralized stablecoin operators Tether and Circle moved rapidly to blacklist $2.85 billion in stolen tokens. This administrative intervention immediately halved the attackers' active balance sheet. To protect the remaining liquid capital, the perpetrators deployed automated routing scripts across 16 different blockchains. The objective was not to cash out into fiat currency, which presents severe off-ramp Know-Your-Customer (KYC) friction, but to convert highly visible alternative tokens like XRP and SOL into Bitcoin.

By deploying automated cross-chain transactions through decentralized liquidity protocols like THORChain, the attackers systematically stripped away the governance layer of token smart contracts. Over 65,000 transactions were executed through more than 20,000 intermediate wallets to break provenance trails. This programmatic dispersion converted roughly $50 million in XRP alongside near-total holdings of stolen SOL into approximately 1,650 BTC.

The incentive structure here explains why 18,270 BTC directly acquired in the initial intrusion remains completely dormant across 19 addresses. Moving native Bitcoin on-chain exposes it to real-time clustering algorithms used by institutional tracing firms. Conversely, alternative tokens face deeper liquidity fragmentation and lower structural privacy. The attackers systematically converted those volatile, non-Bitcoin assets first, concentrating value into Bitcoin addresses that now hold both native and bridged reserves.

With $3.11 billion remaining in attacker-controlled addresses—principally composed of ETH and BTC—the threat actors have established a holding pattern. Because automated laundering patterns were executed without evidence of artificial intelligence-driven routing, the operational footprint relies on pre-programmed multi-chain arbitrage and automated liquidity sweeping. For enterprise security desks and decentralized exchanges, this demonstrates that non-custodial cross-chain bridges remain the primary systemic bridge between multi-token exploits and native base-layer settlement.

• Cross-Chain Bridge Operators and Liquidity Providers: Protocols like THORChain bear immediate counterparty risk, handling tainted transaction flows that attract heavy forensic tracking and liquidity pool imbalances.
• Centralized Exchange Compliance Officers: AML and transaction monitoring desks must flag and quarantine thousands of secondary and tertiary wallet hops spawned across 16 networks before funds reach off-ramps.
• Digital Asset Treasury Managers: Custodians holding cross-chain assets face prolonged settlement delays and heightened counterparty verification requirements as exchanges slowly reopen phased withdrawals.
• Binance Platform Users: Traders in affected token ecosystems encounter rolling withdrawal pauses while infrastructure security audits clear impacted chains.

• Movement of the 18,270 Dormant Bitcoin: Any initial balance change in the 19 primary holding addresses will indicate whether the group plans direct peer-to-peer distribution or long-term dormant holding.
• Liquidity Depletion on Cross-Chain Swaps: Tracking whether DEX bridge volume remains elevated will show if the remaining $3.11 billion in active assets attempts the same automated conversion playbook.
• Secondary Stablecoin Blacklist Updates: Monitoring whether centralized issuers freeze any further derivative addresses interacting with the 20,000 intermediary transit wallets.