Blockchain analytics firm Elliptic reported that hackers behind the $6.43 billion crypto theft from Binance swapped $124 million in stolen altcoins for Bitcoin as the exchange carried out its phased reopening of withdrawals for customers. The transactions coincided with Binance beginning to restore withdrawal capability after the October 29 attack.
Hackers move stolen assets across blockchains
Elliptic found that the hackers exchanged the stolen altcoins for approximately 1,650 BTC but clarified these swaps do not represent net withdrawals from the market, as the funds simply shifted from one cryptocurrency to another. This activity is distinct from the $1.48 billion component of the theft connected directly to the October exploit.
Elliptic’s research indicated that hackers have moved $50 million in XRP and that $226 million in digital assets remain in wallets linked to the exploit. Nearly all of the pilfered Solana, worth about $87 million, has already been swapped, bridged, or moved in transactions obscuring its origin.
Elliptic’s estimates show that $2.85 billion, or 44.3% of the stolen assets, have been frozen. Meanwhile, $3.11 billion—about 48.4%—are still held in wallets connected to the theft. In total, this sums to $5.96 billion of the $6.43 billion stolen; around $470 million remains unaccounted for, with discrepancies attributed to shifting asset values and differing report timings.
| Status | Amount | Percentage of Total |
|---|---|---|
| Frozen | $2.85 billion | 44.3% |
| Held in Linked Wallets | $3.11 billion | 48.4% |
| Unaccounted For | $470 million | 7.3% |
| Total Stolen | $6.43 billion | 100% |
Elliptic emphasized that only a minor portion of the stolen funds have been withdrawn from the ecosystem so far.
Advanced laundering tactics complicate tracking
Elliptic traced more than 20,000 crypto wallets connected to the hackers across 16 blockchains and 65,000 transactions. While the laundering process appears highly automated, current analysis provides no evidence of direct AI involvement.
TRM Labs, a risk and compliance analytics company, disclosed that the group used self-created tokens and liquidity pools on the Tron blockchain to mask ownership. By moving assets through NFT-like lending receipt tokens and cross-chain bridges, the hackers evaded asset freezes by exchanges and tracking firms.
Mini dictionary: TRM Labs is a blockchain intelligence platform assisting organizations in fraud detection and compliance by analyzing illicit on-chain activities.
Chainalysis, another blockchain analytics firm, monitored a separate incident where $325 million in stablecoins were rapidly exchanged for $285 million in Ether within 20 minutes, seemingly to avoid freezing mechanisms.
Some converted XRP traveled via the decentralized liquidity protocol THORChain. Following a request from the US Federal Bureau of Investigation (FBI), the project’s main website blocked flagged addresses, though independent processing nodes continued to execute transactions.
Binance’s liquidity and customer compensation
Binance, the world’s largest cryptocurrency exchange by trading volume, announced in early November that it was reopening withdrawals for HYPE, INJ, APT, PLASMA, NEAR, and LTC. The company stated that it had restored 98% of affected token balances by October 31 and committed to covering customer losses, although asset replenishment does not equate to asset recovery.
The resumption of withdrawals tested Binance’s liquidity. Data from digital asset trading firm Talos showed net outflows reached $6.1 billion, while the depth of Bitcoin order books within 1% of the market price dropped 28% on the first day. Levels fell to about 44% below pre-hack norms near November 1 before rebounding.
| Date/Status | BTC Order-Book Depth Change | Net Outflows |
|---|---|---|
| Initial Post-Hack | 28% drop | $6.1 billion |
| Near November 1 | 44% below pre-hack | – |
Bitcoin’s price also fell about 5% following the incident. Despite these shocks, Talos detected only limited spillover to the broader crypto market compared to the market-wide contagion during the FTX collapse.
Regulatory focus and security vulnerabilities
The FBI connected the theft to North Korea’s TraderTraitor group in late October, publishing wallet addresses tied to the hackers and urging DeFi service providers, THORNode operators, and instant exchanges to block suspicious transfers.
Binance’s internal investigation outlined the attack’s origins in basic cyber vulnerabilities. Attackers interviewed a staff engineer with fake credentials, installed malware on the victim’s computer, and then abused an internal AI tool to access wallet transaction systems.
Analysts have pointed out the dual challenge for global crypto exchanges: defending their workforce and infrastructure from social engineering and digital intrusion, while addressing the ongoing attempt to trace, freeze, and recover stolen digital assets as they pass through a fragmented and decentralized financial system.
