Elliptic says Binance hackers converted $175m in stolen altcoins to 2,300 BTC
The attackers behind the 29 Oct 2026 Binance breach have swapped stolen solana, XRP and tron for Bitcoin, according to Elliptic, while Arkham's data shows no matching jump in their BTC balance.
Why it matters: The breach is the largest crypto exchange hack in dollar terms, and Elliptic's tracing shows the stolen funds being spread across chains and wallets, complicating recovery.
Key points
- Elliptic says about 2,300 BTC, worth $175m at 7 Nov prices, came from converted stolen altcoins.
- The laundering used more than 20,000 wallets on 16 blockchains and at least 65,000 transactions, per Elliptic.
- Arkham recorded 18,384.725 BTC tied to the attackers at 10 a.m. ET on 7 Nov 2026, up from 18,270.2 BTC.
Elliptic says the hackers behind the Binance breach have converted $175m in stolen altcoins into roughly 2,300 BTC, enlarging their Bitcoin pile. The 29 Oct 2026 hack, which drained 18,270.2 BTC from the exchange, is the largest crypto exchange breach in dollar terms.
Elliptic co-founder and chief scientist Dr. Tom Robinson published the analysis, covering activity through Saturday, 7 Nov 2026. Robinson's report repeatedly links the attackers to North Korea.
About $90m of the stolen funds came from solana, with much of the proceeds turned into Bitcoin, while XRP and tron also fed the conversions. Thorchain was used for cross-chain swaps, and roughly 88 BTC, worth $6.7m, passed through Wasabi Wallet coinjoins by 7 Nov. Robinson said the main Bitcoin and ethereum holdings remain untouched.
ET on 7 Nov 2026. Arkham's records show Bitcoin deposits from Thorchain vaults on the Saturday and tron token swaps through Sun.io.
Live updates on NewsFeeds:BitcoinDesk editor: Keshav Aggarwal (accountable for this page; this summary was not edited by hand)
How this was produced: an AI model wrote this summary of Bitcoin.com News’s report, which we credit and link above. Read our Editorial and AI policy. Spotted a mistake? See Corrections.
Not investment advice. Read the risk disclaimer.
