Hackers laundering assets stolen from Binance have converted roughly $175 million into bitcoin, according to Elliptic's November 7 update, published at 08:00 UTC. The blockchain forensics firm counted approximately 2,300 BTC accumulated through conversions of other stolen assets.
BitcoinNews circulated the finding later that day. The figure measures assets converted into bitcoin, rather than proceeds successfully withdrawn into conventional money. Elliptic assesses that cash-outs have probably been negligible so far.
The attackers have made progress changing the form of their holdings. Their ability to spend the proceeds depends on another transaction, with a counterparty willing to accept them.
Bitcoin becomes the destination
Elliptic's running investigation counted more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. Those figures describe activity since the theft, as assessed in its November 7 update.
The conversion total had risen from about 1,650 BTC, valued at $124 million at 08:45 UTC on November 6. XRP swaps through THORChain contributed to the increase.
Elliptic also reported approximately $3.13 billion remaining in addresses linked to the theft and $2.85 billion frozen or seized. These are dated investigative estimates, rather than a live balance sheet.
The stage each balance has reached helps explain the prospects for recovery. A frozen token balance, an asset waiting in an attacker-controlled address and bitcoin received after a swap represent different recovery problems. Combining them under a single “laundered” total would obscure those differences.
The bitcoin conversion figure tracks one part of that process. It should not be read as a new loss on top of the original theft.
The first swaps came at a cost
Chainalysis's investigation offers an earlier view of the attackers' priorities. It attributes the approximately $6.4 billion October 29 theft to TraderTraitor, a North Korean cybercrime group. Its assessment was strengthened by the mixing of Binance proceeds with funds from the September Bitget theft.
During the initial response, the attacker moved $500 million in stablecoins into a wallet used for conversions. Over nearly 20 minutes, $325 million in stablecoins was exchanged for $285 million in ETH, according to Chainalysis.
That is a $40 million difference between the stated input and output values, about 12% of the input. Chainalysis describes the activity as an attempt to get ahead of asset freezes.
The company reported roughly $2.8 billion frozen as of 11:30 a.m. Eastern Time on November 3. It also observed repeated transaction patterns: new addresses received exactly 1 TRX, then additional funds, before forwarding assets onward.
Those observations support its assessment that software was distributing the proceeds. Repetition gave investigators a pattern to follow.
An attacker may accept a poor execution price when the alternative is losing access to the entire balance. Preserving the ability to move funds can take priority over preserving their quoted value. The reported swap illustrates that tradeoff: accepting an immediate reduction in value can serve the broader effort to keep stolen assets moving.
The remaining obstacle is acceptance
For an exchange receiving a deposit, the asset's current identity answers only part of the question. A bitcoin balance can originate from the sale of a different stolen token. Screening that considers only the final transfer would miss the earlier conversion.
Receiving businesses therefore need to consider whether their review can connect a deposit with the preceding movement of stolen assets. Chainalysis says it updates address labels as new information emerges, allowing customers to identify exposure.
For users, custody determines who controls the assets. An exchange account places control over withdrawals with the exchange. Holding assets through self-custody options changes who authorizes movement, while leaving the holder responsible for protecting that authority. Neither arrangement turns a successful transaction into evidence that its recipient is trustworthy.
In this incident, a rising bitcoin conversion total indicates progress through the laundering process. Assessing recovery prospects requires attention to the receiving services and counterparties, alongside the amount converted. Those are the businesses and participants whose willingness to accept the assets determines whether the attackers can move closer to spending the proceeds.
Overview
The reported $175 million concerns stolen Binance assets converted into bitcoin. Elliptic's November 7 assessment places the operation between the original theft and an eventual cash-out, with substantial balances still identifiable or frozen.
Chainalysis's earlier findings explain the urgency behind the first conversions: the attacker exchanged $325 million in stablecoins for $285 million in ETH while attempting to outrun freezes.
