Binance hackers swap $124M of stolen altcoins into Bitcoin as withdrawals reopen

The perpetrators behind the $6.43 billion Binance coin theft have exchanged $124 million worth of stolen altcoins for Bitcoin, according to an Elliptic report published on November 6. These swap transactions coincide with Binance reopening its customer withdrawal services.

Converting altcoins, not cashing out

Resulting in roughly 1,650 BTC, the hackers’ altcoin conversions are separate from the $1.48 billion initially stolen during the October 29 attack. To date, approximately $50 million in XRP has been shifted, while $226 million remains inside the hackers’ wallets. Nearly all of the stolen Solana—valued at around $87 million—has been swapped for alternative cryptocurrencies, bridged across blockchains, or routed through obfuscation transactions meant to hide its origins.

Even so, these recent figures do not offer a complete picture regarding the status of the pilfered funds. Elliptic’s estimates show that $2.85 billion has been frozen (representing 44.3% of the total), whereas $3.11 billion stays parked in linked wallets (accounting for 48.4%). Together, these figures account for $5.96 billion out of the total $6.43 billion stolen, leaving $470 million (7.3%) unaccounted for in the documented totals. These inconsistencies may stem from variations in reporting times and asset valuations.

Because the hackers merely traded one cryptocurrency type for another, the $124 million converted into Bitcoin should not be viewed as a separate cash-out amount. In this light, Elliptic notes that only a minor fraction of the stolen money has actually been withdrawn.

How the laundering keeps moving

The illicit funds have been fragmented across multiple transactions. Elliptic’s analysis reveals that over 20,000 crypto wallets, 16 distinct blockchains, and 65,000 transactions have been tracked. Although the operations appear automated, there is no proof that artificial intelligence agents are driving them.

According to TRM Labs, the attackers generated tokens and liquidity pools on Tron to mask transfers. They also funneled capital through lending receipt tokens and interconnected blockchain bridges to bypass wallets vulnerable to asset freezes.

Previously, Chainalysis monitored $325 million in stablecoins being converted into $285 million of Ether within a 20-minute window, seemingly to preempt freezes.

Certain XRP conversions were routed via THORChain. As Cryptopolitan reported, while its website blocked flagged addresses following an FBI directive, independent nodes kept processing the transactions.

Reopening withdrawals and the liquidity test

Binance is bringing withdrawals back online while the stolen capital stays active in the market. In a November 6 update, the platform stated its intention to restore withdrawals for HYPE, INJ, APT, PLASMA, NEAR, and LTC by the end of the following week.

Furthermore, Binance announced that it had replenished 98% of the impacted token assets by October 31. The exchange committed to absorbing customer losses, though replacing stolen funds is not the same as recovering them.

This resumption of services has strained Binance’s liquidity. Talos documented $6.1 billion in net outflows. Bitcoin order-book depth within a 1% range dropped by 28% on the first day and plummeted to a low roughly 44% beneath pre-hack levels around November 1 before staging a recovery.

In the wake of the attack, Bitcoin prices dipped by about 5%. Even so, Talos observed minimal indications of wider market contagion relative to the FTX collapse.

What it means for exchanges and compliance

On October 31, the FBI attributed the breach to North Korea’s TraderTraitor collective, publishing addresses tied to the hackers and calling on THORNode operators, DeFi platforms, and instant exchanges to block associated transactions.

Despite the sophisticated laundering tactics, the breach began with conventional security vulnerabilities. Binance’s internal investigation detailed a fraudulent job interview, malware deployed on an engineer’s workstation, and the misuse of an internal AI tool, which collectively allowed the attackers to breach systems tasked with signing wallet transactions.

This incident underscores a dual threat for exchanges: safeguarding staff and high-value systems from intrusions, and preventing stolen assets from traversing decentralized networks.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It’s free.