Elliptic Tracks $124M of Binance Loot Moved Into Bitcoin

Attackers who stole about $6.43 billion from Binance on Oct. 29 have converted roughly $124 million of other stolen tokens into about 1,650 bitcoin, blockchain analytics firm Elliptic said in a Friday update.

That conversion nearly doubled in a day. Elliptic's last refresh, timed at 08:45 UTC Nov. 6, put about $3.11 billion still sitting in linked addresses, mostly ether and bitcoin that have not moved. About $2.85 billion of the original haul has been frozen or seized, largely by stablecoin issuers.

How the swaps work

Cross-chain swap protocols such as THORChain let a wallet send one asset on one blockchain and receive another asset on a different chain, without a centralized custodian. Elliptic said most of Friday's newly converted bitcoin came from stolen XRP routed that way: about 42 million XRP, worth about $50 million, had left since Thursday afternoon, leaving about 192 million XRP, or $226 million, still held. Nearly all of the stolen Solana has already been swapped, bridged or mixed, with much of that value ending in bitcoin wallets, Elliptic wrote.

The firm has mapped more than 20,000 wallets across 16 blockchains and at least 65,000 transactions. It said only a "negligible amount" has likely been cashed out into fiat. The original 18,270 bitcoin taken from Binance, split across 19 wallets, has not moved since the theft night. The FBI has attributed the attack to North Korea's TraderTraitor operation; Pyongyang has denied responsibility, Bitcoin.com News reported, citing the attribution.

Elliptic expects remaining ether to be swapped into bitcoin in small batches before cash-out attempts through over-the-counter brokers. Binance has been reopening withdrawals in stages after the breach.

In our opinion: Elliptic still puts cash-out at a negligible amount. The freeze that caught $2.85 billion already did the hard work; the next checkable step is whether exchanges and OTC desks stop the converted bitcoin before it leaves the chain.