Elliptic traces $124M in Bitcoin conversions from Binance hack

What happened

Blockchain intelligence firm Elliptic released a November 6 update tracking the movement of stolen assets from the October Binance breach, finding that roughly $124 million had been converted into Bitcoin. The conversion involved funds originally denominated in multiple cryptocurrencies, including approximately $50 million in XRP and stolen Solana tokens that had been swapped, bridged or mixed through various services.

By Elliptic's November 6 checkpoint, analysts identified about 1,650 BTC held in new addresses following conversion from other stolen assets. The investigation describes activity involving tens of thousands of wallets across multiple networks, representing an ongoing and rapidly evolving laundering operation. Elliptic cautioned that an estimated figure tied to a specific timestamp should not be treated as a permanent total, since wallet clusters can change as additional transactions occur.

The scale of the tracing effort underscores the complexity of the operation. By November 9, Elliptic's separate laundering tracker put the total operation at more than 20,000 wallets across 16 blockchains, covering at least 36 services and 65,000 transactions. Since November 8, wallets linked to the theft have deposited roughly 7,000 ETH, valued at approximately $15 million, into Tornado Cash, a privacy mixer service.

Why it matters

Understanding the distinction between cryptocurrency conversion and actual cash-out matters significantly for compliance and recovery efforts. Converting stolen Bitcoin does not mean the funds have entered the conventional financial system or that the attacker has spent or cashed out the money. The coins remain recorded on the blockchain and traceable by analysts, meaning law enforcement and blockchain intelligence firms can continue monitoring their movement. This traceability creates ongoing pressure on the actors to launder the funds through additional steps if they want to convert them to fiat currency.

Cross-chain movement complicates tracing but does not eliminate it. Funds passing through pools, aggregators and intermediaries on different networks become harder to follow, yet the public nature of blockchain transactions and the ability to connect wallet activity through known services allows investigators to reconstruct substantial portions of the flow. Elliptic's November 9 data showed that approximately $3 billion remained in theft-linked addresses while $2.85 billion was frozen, with only negligible amounts estimated to have been cashed out by that point.

What the data shows

Elliptic's investigation also revealed laundering techniques designed to obscure the trail. North Korea-linked actors created throwaway memecoins to move roughly $430,000 from the stolen funds through decentralized exchange pools. The operators minted six tokens, FUK, OLCCL, MEILI, MMLI, DABI and SINU, between November 5 and 7, each costing around 25 NEAR or approximately $90 to create. They paired these tokens with NEAR in separate trading pools and routed approximately 117,000 stolen NEAR through them. By routing funds through pools rather than direct transfers, the receiving accounts could resemble traders taking profits, potentially evading initial compliance detection.

Similar activity appeared on other networks. Comparable laundering occurred on Tron, while a related route on Solana used existing, thinly traded tokens. Elliptic cautioned that compliance teams should not assume funds are clean simply because they arrive from a liquidity pool, warning that on-chain trails can still be followed and the technique merely delays investigators by introducing cheaply created tokens that are discarded after use. The technique predates this theft; Elliptic identified its use after the 2025 Bybit hack.

Background

Binance disclosed the breach on October 31, attributing it to North Korean-linked actors and disclosing a $6.34 billion impact. The exchange described a months-long intrusion involving compromised developer software, fake recruitment interviews and unauthorized access to internal systems. In June, an earlier encounter involving a tampered Homebrew installation had exposed an engineer's role and colleagues, according to Binance's account. The breach ultimately led to compromised container deployment credentials that provided access to wallet signing operations, though Binance stated it found no evidence that wallet private keys had leaked.

What to watch

Recovery efforts remain incomplete and subject to governance processes. Binance identified 8,425.997 ETH and 74.56 million ARB immobilized on Arbitrum and submitted a November 5 request for their return. Arbitrum's Security Council temporarily upgraded a contract to move the assets into a frozen address, but moving those balances again requires DAO approval. Binance proposed returning the existing frozen assets through a temporary contract upgrade without seeking a fresh treasury allocation. The exchange estimated that the discussion, voting and execution process could take seven weeks or longer, with a proposed schedule including a week of forum discussion, a weeklong temperature check, a two-week onchain vote and roughly 18 additional days before execution following approval.

Questions readers ask