Binance Hackers Converted $124M in Altcoins to Bitcoin, Elliptic Says

Attackers behind the $6.43 billion Binance breach have converted roughly $124 million in stolen altcoins into bitcoin, according to blockchain analytics firm Elliptic. The figure sits on top of the $1.48 billion in bitcoin taken directly in the attack, which investigators attribute to North Korea.

Elliptic's update, published this week, maps a laundering operation of unusual scale. The attackers have used more than 20,000 wallets across 16 blockchains and roughly 65,000 transactions to obscure the origin of the funds. Despite that infrastructure, Elliptic estimated that only a "negligible amount" has likely been cashed out so far.

Where has the converted bitcoin come from?

The largest single source is XRP. Elliptic's report said that by early Friday, roughly $50 million in XRP had been swapped, primarily into bitcoin, through the THORChain protocol. About $226 million in XRP remained unswapped at that point.

Solana has moved faster. Nearly all of the stolen SOL has already been mixed, swapped or bridged into bitcoin, according to the report.

The remaining balances tell a mixed picture. Around $3.11 billion, mostly in ether and bitcoin, still sits in addresses linked to the attack. Of the total $6.43 billion stolen, $2.85 billion has been frozen. That leaves roughly $470 million unaccounted for. Elliptic did not specify whether that gap reflects price changes since the attack, funds already cashed out, or both. The Block has contacted the report's author, Elliptic co-founder Tom Robinson, for clarification.

Elliptic expects the attackers to follow a familiar playbook for the rest of the haul: swap the remaining ether into bitcoin in small batches, then attempt to cash out through over-the-counter brokers and Chinese money laundering networks.

Were AI agents running the laundering?

Speculation had circulated that autonomous AI agents were executing the automated swaps. Elliptic rejected that theory outright.

"The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," the firm said.

The distinction matters for investigators. Scripted automation implies pre-built infrastructure that chain analysts can fingerprint and trace, whereas adaptive AI-driven laundering would complicate heuristic clustering of attacker addresses.

How did the attack unfold, and what is Binance reopening?

Binance's own incident report, published Tuesday, reconstructed the intrusion. The attackers operated over months and used a tampered developer tool, a fake job interview and compromised internal AI tooling to reach Binance's wallet-signing infrastructure. The company has since replenished virtually all of the assets stolen in the breach.

On Friday, Binance wrote on X that it aims to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the "end of next week." It also targets reopening withdrawals "for all tokens on networks that are already restored," including Ethereum, BNB Smart Chain, Arbitrum and Optimism.

The staged reopenings limit immediate user exposure while Binance verifies signing infrastructure network by network. For institutional counterparties, the frozen $2.85 billion and the slowly converted altcoin pile remain the operative risk metrics.

The next checkpoint is Binance's end-of-next-week deadline for the six additional tokens. How much of the remaining $3.11 billion moves into bitcoin, and through which swap venues, will test both exchange risk controls and the tracing capacity Elliptic has deployed across 16 chains.