TLDR:
- Binance hack attackers converted $175 million in stolen altcoins into roughly 2,300 BTC. The swaps changed the form of previously stolen assets.
- Elliptic tracked more than 20,000 wallets across 16 blockchains. The laundering involved at least 36 services and 65,000 transactions.
- Elliptic tracked 88 BTC entering coinjoins in its November 7 account. It said the primary bitcoin and ether holdings remained dormant.
- Arkham’s labeled balance showed a much smaller increase than Elliptic’s conversion estimate. The difference between the reports remains unresolved.
Attackers behind the Binance hack converted $175 million in stolen altcoins into approximately 2,300 BTC, blockchain analytics firm Elliptic reported. The additional bitcoin came from exchanging assets already taken during the October 29 exchange breach.
Elliptic’s report, updated November 7, described extensive transfers across thousands of wallets, multiple blockchains, and dozens of services. Its detailed daily account also tracked bitcoin entering coinjoins, which complicate tracing.
Binance Hack Report Tracks $175 Million in Bitcoin Conversions
Elliptic co-founder and chief scientist Tom Robinson described the Binance hack laundering operation as heavily automated. His analysis counted more than 20,000 wallets across 16 blockchains, involving at least 36 services and 65,000 transactions.
The pace averaged roughly one new wallet every 30 seconds and one transaction every 10 seconds. Those figures describe aggregate activity rather than proof that artificial intelligence directed the transfers.
Stolen altcoins, including SOL, XRP, and TRX, contributed to the Bitcoin conversions. About $90 million in SOL moved through swaps, bridges, and privacy services, with much of the value eventually becoming bitcoin.
Bitcoin laundering also involved THORChain, which facilitated conversions between networks. Ethereum made up a smaller part of the assets converted, while the primary Bitcoin and Ether holdings remained stationary.
The November 7 entry said about 88 BTC, valued at $6.7 million, had entered Wasabi-style coinjoins. These transactions combine inputs from multiple participants, making direct links between incoming and outgoing bitcoins more difficult to identify.
Robinson also identified about 412,000 NEAR, worth $1.5 million, leaving the main account in small batches. The Binance hack report placed the newly converted 2,300 BTC in separate bitcoin addresses.
Wallet Totals Differ as Investigators Trace Stolen Funds
Reportedly, 18,384.725 BTC in the Arkham-labeled entity at 10 a.m. Eastern on November 7. That compared with the 18,270.2 BTC drained during the Binance hack.
The difference was roughly 114.525 BTC, well below Elliptic’s 2,300 BTC conversion estimate. Arkham’s entity page reviewed for this article displayed approximately 18,387 BTC in its labeled wallets. news.bitcoin.com
Those readings do not by themselves reconcile the two platforms. A comparison would require matching addresses, timestamps, and assumptions about which wallets belong to the attackers.
Elliptic’s figure covers converted stolen altcoins, while Arkham’s balance covers addresses grouped under its entity label. Differences in coverage or timing could explain the gap, although the available reports do not establish the cause.
Bitcoin deposits from THORChain vaults and TRX swaps through Sun.io. Those records show ongoing activity connected to the Binance hack, alongside the dormant primary bitcoin holdings.
Bitcoin laundering remains distinct from cashing out proceeds into spendable funds. Elliptic assessed that only a negligible amount had likely reached that stage, despite extensive transfers between assets.
Investigators examining the Binance hack identified unauthorized access to an internal wallet signing service. Binance described compromised employee devices and malicious software preceding the unauthorized transfers.
Binance said it had closed the identified entry points and rebuilt or replaced affected systems. Its response included tighter device controls and stronger checks on wallet services after the incident.
Binance put the affected assets at approximately $6.34 billion in its November 3 incident report. The exchange said it had set aside more than enough funds to absorb the financial impact.
Binance also cited FBI information attributing the incident to North Korea. It said 98% of impacted token assets had been replenished by October 31, while purchases of remaining illiquid assets continued. The company reported approximately $2.85 billion in frozen or intercepted assets, subject to reconciliation and changes in market prices.
