Binance hack: stolen altcoins now sit as about 2,300 BTC worth $175 million, and the main BTC and ETH still have not moved

How the converted pile grew

Elliptic's report counts bitcoin that arrived in new addresses after the thief swapped other stolen coins. The count has moved like this:

The latest step is about 39% in under a day, by our arithmetic. Set against the whole theft, the pile is still small. It equals about 12.6% of the 18,270 BTC taken directly, and $175 million is about 2.7% of the $6.43 billion total Elliptic uses.

The coins come from several routes. Elliptic names SOL, XRP, Tron and ETH as the sources. All of the stolen SOL, about $90 million, has been swapped, bridged or mixed, and much of it ended up as bitcoin. Tron carried most of the early laundering, about $230 million in TRX, and about $1 million remains there.

XRP is now driving the increase

About 44 million more XRP, worth $51 million, left the thief's XRP addresses overnight into November 7. Most of it went through THORChain into bitcoin, Elliptic says. That leaves about 148 million XRP, or $173 million, in addresses linked to the theft. About $100 million of the XRP has been swapped so far.

The pace has changed quickly. All 233 million XRP sat untouched in six new addresses from November 2 until November 5. By our arithmetic, 148 million out of 233 million means about 64% of the stolen XRP has yet to take the route. Elliptic says most of what remains sits in three of the six addresses, and those three have not moved since November 2.

For scale, our market feed showed about $531 million of XRP volume over 24 hours at 00:50 SGT on November 8. The remaining $173 million is about a third of that. Elliptic's account suggests why the thief splits amounts into small batches: smaller sums can be swapped or bridged without moving prices, and they stand out less to exchanges that screen incoming funds.

More of the bitcoin went through coinjoins

About 53 BTC, worth $4 million, went into Wasabi-style coinjoins overnight, much of it bitcoin that THORChain had just paid out. Elliptic's timeline puts the total mixed this way at about 88 BTC, or $6.7 million. That is about 3.8% of the 2,300 BTC.

One inconsistency sits inside the report. Its key points still say about 77 BTC ($5.8 million) since November 1, while its November 7 entry says 88 BTC. Bitcoin.com News used the 88 figure, and so do we, since it comes from the newest entry. The report opens with a warning that the situation is evolving and its description may be incomplete.

A coinjoin combines many users' bitcoin in one transaction, which breaks the visible link between coins going in and coins coming out. Elliptic says the coinjoins in this case had between 101 and 491 inputs each. Separately, about $6.7 million in ETH and SOL has gone into the Privacy Cash pool since November 3. The matching dollar figure is a coincidence of rounding, and the two amounts are different funds.

How the laundering works at this scale

Elliptic's totals since the theft are more than 20,000 wallets, 16 blockchains, at least 36 services and at least 65,000 transactions. That works out to roughly one new wallet every 30 seconds and one transaction every 10 seconds, the firm says.

The firm rejects the speculation that AI agents are moving the money. It points to fixed timing, set amounts, blind retries, and new tactics introduced in steps hours apart, plus pauses that look like human working patterns. On Tron alone the funds moved in about 32,000 transactions, peaking at around 1,300 in one hour, and each dollar moved about nine times. Its conclusion is conventional automation, with nothing showing an AI agent making decisions.

THORChain shows how quickly the routes can change. The protocol halted swaps on most of its chains at 19:34 SGT on October 31 after a technical fault, and the thief's deposits there stopped soon afterwards. The thief switched to other bridges during the halt. THORChain resumed swaps late on November 3, and by the evening of November 4 about 12,200 ETH, worth $29 million, had gone through it into bitcoin.

Arkham's count does not show the same rise

Bitcoin.com News checked Arkham Intelligence and found a different picture. At 10 a.m. ET on November 7, which is 23:00 SGT, Arkham attributed 18,384.725 BTC to the attackers. That is only about 115 BTC above the original 18,270.2 BTC, and nowhere near an extra 2,300. Arkham's records did show bitcoin deposits from THORChain vaults on the same day, and TRX swaps through Sun.io.

Odaily carried the same comparison at 00:40 SGT on November 8, citing Bitcoin.com News. Neither outlet explains the gap. Our reading is that the two trackers may label different address sets, since Elliptic counts coins it traces into newly created addresses. We could not test that from public pages, so treat the 2,300 BTC as Elliptic's tracing result and not a figure every tracker agrees on.

What has not moved

Elliptic's snapshot of the $6.43 billion looks like this:

The dollar lines use different valuation times, so they should not be added up to reach the total. The 18,270 BTC was split into 19 addresses in the first half hour and has stayed there.

Elliptic believes the unmoved funds are very likely still held by North Korea, and that funds already being laundered may have passed to Chinese money laundering networks. On-chain data cannot show whether that handover has happened. The report also says around $16 million went to addresses that also hold proceeds of the September 2026 Bitget exploit, which it believes was the work of the same group, TraderTraitor. The FBI named that group on October 31, and North Korea has denied the attribution, as we covered in our earlier report on the denial.

What Elliptic expects next

After the Bybit theft of February 2025, North Korea laundered all 499,000 stolen ETH within ten days, mostly by swapping it for bitcoin. Cashing out then took months, and Elliptic found the funds were eventually turned into USDT on Tron and sold through suspected Chinese over-the-counter services.

Elliptic calls the Binance laundering slower so far, for three reasons it gives. ETH and BTC cannot be frozen, so there is no rush. The sums are more than twice those stolen from Bybit, so fast selling would mean large swap losses. The FBI has also published the addresses, so services are watching. The firm expects the ETH to be swapped for bitcoin in many small transactions and then sold through OTC brokers over months.

Further freezes will be harder, Elliptic says. Its best remaining chances are stablecoins caught briefly in transit and centralized services at the point of cash-out.

How the market looked

We found no report linking this update to a price move, and the numbers below only describe the session. Our feed at 00:50 SGT on November 8 showed BTC down 0.08% over 24 hours near $75,689, and XRP down 2.93% near $1.158. OKX's public ticker a few minutes later showed BTC at $75,753.9 and XRP at $1.1593.

Our liquidations page recorded about $45.65 million over 24 hours across Binance and OKX at 00:05 SGT. PANews, citing CoinGlass, reported $81.18 million across the wider market on November 7, of which $54.21 million was longs. BTC accounted for $9.49 million of that total. Funding on XRP stood at 0.01% on Binance and about 0.0058% on OKX in our feed, which you can compare on the funding rates page.

What to check

If you hold XRP, the figure to watch is the 148 million XRP left in the thief's addresses, especially the three large addresses that have not moved. Elliptic updates the same report page, so compare the next update's number with this one.

If you buy BTC or USDT through an over-the-counter seller or a private deal, keep the transaction ID and the seller's details. Elliptic says customers can screen against nearly 18,000 addresses linked to the theft and that a free blocklist is open to any business. So coins passing through these addresses may be flagged by a service that screens deposits. Our reading is that a clean personal record makes any such query easier to answer.

Treat any message offering "Binance compensation" or asking you to reconnect a wallet as a scam until you find the same notice inside your own Binance account or on its official announcement page. Do not sign anything from a link sent to you by direct message.

What we could not confirm

• Why Arkham's total and Elliptic's count differ by about 2,185 BTC.
• How much of the converted bitcoin still belongs to North Korea and how much has passed to laundering networks. Elliptic says on-chain data cannot show this.
• Whether any of the XRP swaps affected exchange order books. No source we opened measures that.
• The current figures. Elliptic's numbers stop at 16:00 SGT on November 7.

Quick answers

How much stolen Binance crypto has been turned into bitcoin?

About 2,300 BTC, worth $175 million, sits in new addresses after conversion from other stolen assets, according to Elliptic's update of 16:00 SGT on November 7. This is separate from the 18,270 BTC taken directly.

Have the hackers sold the bitcoin for cash?

Very little, by Elliptic's estimate. The funds have changed asset but remain on public blockchains in addresses linked to the theft. Its main BTC and ETH holdings have not moved.

How much of the stolen XRP is left?

About 148 million XRP, worth $173 million, remains in addresses linked to the theft, out of about 233 million stolen.

How much has been frozen?

Elliptic counts $2.85 billion frozen or seized, about 44% of the $6.43 billion. After the Bybit hack, around 3% was frozen.