Elliptic Traces 1,650 BTC Converted from $124M in Stolen Binance Assets Across 16 Blockchains

The conversion of $124 million into Bitcoin across 16 blockchains demonstrates that state-aligned cyber syndicates can bypass centralized checkpoints by systematically exploiting permissionless cross-chain architecture.

• The asset flight begins: Between October 29 and November 6, 2026, actors identified by the FBI as TraderTraitor systematically converted $124 million in stolen Binance assets into approximately 1,650 Bitcoin.
• Automated multi-chain routing: The group dispersed funds across 20,000 unique wallets, using 36 distinct services, cross-chain bridges, decentralized mixers, and platforms such as THORChain to clear $50 million in XRP and virtually all stolen Solana.
• The balance sheet split: While stablecoin issuers Tether and Circle successfully froze $2.85 billion of the total $6.43 billion stolen, roughly $3.11 billion remains static on-chain with negligible conversion to fiat currency.

• Record-breaking scale: The October 29 compromise extracted $6.43 billion across 11 chains, surpassing the previous record set by the 2025 Bybit breach.
• State-sponsored mechanics: TraderTraitor operates under heavy economic sanctions, which eliminate traditional trade rails and create an institutional incentive to acquire liquid, unfreezable digital assets.
• Centralized freeze limitations: Private issuers can lock smart-contract tokens like stablecoins instantaneously, but native layer-1 assets like Bitcoin and decentralized swap liquidity pools operate without administrative kill-switches.

The operational flow observed by Elliptic exposes a shift in how illicit capital navigates technical bottlenecks. When $6.43 billion was removed from Binance on October 29, the attackers faced two immediate structural constraints: centralized issuer intervention and secondary-market liquidity depth.

Centralized stablecoins represent an immediate counterparty risk for illicit actors. Because Tether and Circle can alter token contract registries to blacklist addresses, $2.85 billion in stablecoins was immobilized shortly after the theft. To preserve the remaining value, TraderTraitor prioritized turning volatile, heterogeneous layer-1 tokens—primarily Solana and XRP—into Bitcoin, the deepest and least censorable liquidity market in the digital asset space.

The execution relies entirely on programmatic automation. Rather than moving capital through single points of exchange, the attackers triggered an automated dispersion pipeline that routed capital across 20,000 wallets on 16 independent blockchains. Over 65,000 individual transactions were documented across 36 routing services. For example, $50 million of XRP was moved through THORChain, a decentralized cross-chain protocol that settles trades natively without wrapped tokens or custodial gatekeepers. By swapping into native Bitcoin via THORChain, the actors severed direct transaction-graph linkages back to the initial exploit addresses.

This strategy converts altcoin exposure into 1,650 BTC without relying on centralized order books where KYC (Know Your Customer) barriers trigger asset freezes. Concurrently, the 18,270 BTC extracted during the initial compromise—worth billions—remains untouched across 19 addresses. Moving that volume at once would cause market slippage and immediate tracing alerts. Instead, the attackers are methodically feeding smaller token pools into decentralized cross-chain protocols to establish dispersed Bitcoin treasuries.

The end goal is not an immediate fiat off-ramp. Elliptic’s tracing confirms negligible cash-out activity. For an entity operating under comprehensive financial isolation, holding unseizable, non-custodial Bitcoin is itself an end-state balance-sheet objective. The trade-off is velocity for finality: the attackers accept network transaction fees and protocol swap slippage to eliminate the administrative freeze risk inherent to programmable stablecoins.

• Institutional compliance officers: Must instantly ingest address blacklists covering tens of thousands of newly spun derivative wallets to avoid processing secondary exposure.
• Decentralized exchange liquidity providers: Bear the risk of pooling assets alongside tainted capital, facing sudden liquidity imbalances or protocol-level scrutiny from analytics firms.
• Crypto exchange security architects: Must re-evaluate bridge permissions, withdrawal limits, and real-time behavioral tracing across multi-chain hot wallets.
• Digital asset treasurers: Face increased operational overhead as counterparties demand deeper forensic audits of Bitcoin source pools prior to settlement.

• The static 18,270 BTC reserve: Any outbound movement from the 19 primary holding addresses will signal whether the group attempts secondary distribution or long-term cold storage.
• DEX and bridge compliance integrations: Watch whether cross-chain swap providers deploy automated filtering at the mempool or user-interface layer to block flagged wallets.
• Binance phased withdrawal metrics: The timeline and capital limits of Binance’s reopening will indicate the remaining gap in the exchange's asset reserve structure.