Binance hackers bitcoin swaps reach $124 million
Binance hackers bitcoin swaps have reached about 1,650 BTC, or $124 million, Elliptic says, as stolen XRP and SOL are converted while the main bitcoin and ether stash stays put.
The laundering of the record Binance theft has entered a new phase. Binance hackers bitcoin swaps now total about 1,650 BTC, worth roughly $124 million, according to blockchain analytics firm Elliptic, which updated its tracking on November 6.
What happened
Elliptic said about $50 million of the stolen XRP has now been swapped, mostly into bitcoin, leaving about $226 million in XRP still held. Bitcoin.com, citing the same analysis, reported that about 42 million XRP left theft-linked wallets from Thursday afternoon and that much of it moved through the cross-chain protocol THORChain. The Defiant noted that the bitcoin obtained from other stolen assets nearly doubled in a day.
Solana has already been fully processed: Elliptic said all of the stolen SOL, about $87 million at current prices, has been swapped, bridged or mixed. Roughly $220 million in TRX went through Tron, where about $1 million remains. By contrast, only about $3 million of $1.33 billion in stolen ether has moved, and the original 18,270 BTC taken in the October 29 attack has sat untouched across 19 wallets, according to Bitcoin.com.
The scale of the operation is large. Elliptic's count now exceeds 20,000 wallets spread over 16 blockchains, with at least 36 services and 65,000-plus transactions involved, or about one fresh wallet every 30 seconds. About 33 BTC has gone through Wasabi-style coinjoins since November 1, and about $1.1 million in ETH and SOL entered the Privacy Cash pool, which paused deposits for about a day.
Why it matters
Elliptic estimates $3.11 billion is still sitting in addresses linked to the $6.43 billion theft, mostly in BTC and ETH. Converting smaller assets into bitcoin first matches the pattern seen after the Bybit hack, Elliptic said, and it expects the attackers to swap the ether next before trying to cash out through OTC brokers and exchanges. That makes every Binance hackers bitcoin swaps update a guide to when the larger ether pile might move.
The flows also test the infrastructure the stolen coins pass through. THORChain was already under scrutiny after a THORChain reorg halt tied to the same laundering, and the attribution to North Korea's TraderTraitor group raises the sanctions risk for any service that touches the funds. Bitcoin.com said about $2.85 billion of the original haul has been frozen or seized.
Elliptic's account of the intrusion itself is a warning for the wider industry. It said Binance described a multi-stage campaign in which one engineer installed a tampered AI coding tool in June, another was lured through fake job interviews in September, and the attackers then used an internal AI tool to reach Binance's wallet signing service on October 29.
What's next
The key signal is whether the nine largest ether wallets, idle since October 30, start moving. Exchanges and OTC desks will be screening for deposits tied to the theft, and further Binance hackers bitcoin swaps through cross-chain protocols would likely draw more pressure on those services to block flows.
Elliptic is updating its laundering tracker as the funds move.
This article is for information only and is not investment advice.