Blockchain analytics firm Elliptic reported that individuals behind the Binance hack converted approximately $175 million worth of stolen altcoins into about 2,300 BTC. Elliptic said these conversions stemmed from assets obtained in the October 29 breach of the exchange. The incident led to extensive asset movement across multiple blockchains as the attackers employed a range of services to obscure the trail of funds.
Automated laundering spans thousands of wallets
Elliptic’s research indicated a heavily automated laundering process. Tom Robinson, Elliptic co-founder and chief scientist, calculated the use of more than 20,000 wallets over 16 different blockchains. The operation involved at least 36 services and approximately 65,000 transactions.
According to the report, activity proceeded at an average rate of one new wallet every 30 seconds and one transaction every 10 seconds. These metrics highlight the scale of the asset movements but do not provide direct evidence that artificial intelligence was used to orchestrate the process.
Robinson explained that the attackers moved various altcoins, including SOL, XRP, and TRX, with swaps and cross-chain bridges being utilized to eventually channel value into bitcoin. He pointed out that around $90 million of the total in SOL passed through these mechanisms, ultimately resulting in significant BTC allocations.
Cross-chain activity also relied on THORChain to facilitate direct conversions between networks. Ethereum assets represented a smaller share of the converted funds, while the largest BTC and ETH holdings remained unmoved.
Elliptic tracked at least 88 BTC, valued at $6.7 million, passing into privacy-focused coinjoin services. These transactions blend inputs from multiple users, complicating attempts to link incoming and outgoing bitcoin.
Robinson identified the movement of about 412,000 NEAR, worth $1.5 million, transferred from the main account in several smaller batches. The newly swapped bitcoin was distributed across separate bitcoin addresses, diverging from the consolidated balances drained in the initial hack.
Discrepancies in wallet balances and asset tracing
On November 7, wallet tracking service Arkham displayed 18,384.725 BTC connected to the attackers, compared with the 18,270.2 BTC appropriated during the Binance incident—a difference of roughly 114.525 BTC. However, Elliptic’s analysis suggested the conversion of $175 million in altcoins amounted to 2,300 BTC, a figure not fully reflected in Arkham’s wallet tally.
The available reports could not reconcile the two sets of findings without further address-level, timestamped data and clearer attribution of wallet control. Elliptic’s estimates accounted for moved stolen altcoins, while Arkham’s records tracked labeled BTC holdings at a specific time.
Arkham and Elliptic also observed ongoing movements, with records of BTC entering from THORChain and TRX swaps routed through Sun.io, suggesting continuous laundering and reallocation activities.
Despite complex transfer patterns, Elliptic assessed that only a negligible portion of the stolen funds had been converted into spendable currency, as the majority appeared to cycle between digital assets or remain dormant within wallets.
Exchange response and investigation developments
Investigators determined that the Binance hack resulted from unauthorized access to an internal service used for authorizing wallet transactions. Binance attributed the breach to compromised employee devices, which had been infected by malicious software ahead of the asset withdrawals.
Following the attack, Binance stated that it closed the points of unauthorized access and proceeded to rebuild or replace affected internal systems. Additional security enhancements included stricter device protections and reinforced wallet transaction validation protocols.
In its public incident report on November 3, Binance estimated losses totaling $6.34 billion and confirmed that sufficient reserves had been allocated to cover the impact. The exchange credited the FBI with contributing information linking the operation to North Korea. Binance said it had replenished 98% of impacted tokens by the end of October and reported freezing or intercepting about $2.85 billion in digital assets, with amounts adjusting as market prices fluctuate.
Binance disclosed that it restored nearly all affected token balances for users and continues to acquire the remaining illiquid assets to fully address the breach-related losses.
In light of the fragmented tracking landscape and the technical complexity of ongoing conversions and cross-chain activity, users and analysts need real-time visibility into large-scale crypto flows. CryptoAppsy’s live monitoring tools and coin-specific news features are valuable for following developments like the Binance asset rebalancing. Its live charts and customizable alerts enable users to track sudden wallet changes or network-wide fund movements as they happen.
