Binance hackers swap $124M of stolen altcoins into Bitcoin as withdrawals reopen

According to Elliptic’s report on November 6, hackers responsible for stealing $6.43 billion worth of coins from Binance have swapped stolen altcoins in the amount of $124 million for Bitcoin. These transactions are being conducted simultaneously with Binance’s reopening of its withdrawal function to customers.

Converting altcoins, not cashing out

The altcoin swaps of the hackers yielded approximately 1,650 BTC. They are separate from the $1.48 billion that was stolen as a result of the attack on October 29. Thus far, around $50 million in XRP has been moved while $226 million is still in the wallets of the hackers. Almost all of the stolen Solana, worth around $87 million, has been exchanged for other cryptocurrencies, transferred across blockchains, or moved through transactions designed to hide its origins.

However, the recent numbers do not provide complete information about the status of the stolen funds. The estimate from Elliptic indicates that $2.85 billion has been frozen (44.3% of the total), while $3.11 billion is still held in connected wallets (48.4% of the total). These numbers represent a total of $5.96 billion out of the $6.43 billion stolen. Therefore, there is still $470 million (7.3% of the total) that is still not accounted for in the reported totals. The discrepancies in the value of assets and time of reporting may be the reasons behind the inconsistencies.

The $124 million that has been converted into Bitcoin should not be regarded as a separate amount, as the hackers just traded from one form of crypto to another. In this context, it is important to note that, according to Elliptic, only a small portion of the stolen money has been withdrawn.

How the laundering keeps moving

The stolen funds have been distributed through several transactions. According to Elliptic analysis, more than 20,000 crypto wallets have been traced alongside 16 different blockchains and 65,000 transactions. Although the activity seems to be automated, there is no evidence that AI agents are controlling it.

TRM Labs found that the hackers created tokens and liquidity pools on Tron to conceal transfers. They also moved funds through lending receipt tokens and connected blockchain bridges, bypassing wallets where assets might be frozen.

Earlier, Chainalysis tracked $325 million in stablecoins converted into $285 million of Ether within 20 minutes, apparently to avoid freezes.

Some XRP conversions passed through THORChain. As Cryptopolitan reported, its website blocked flagged addresses following an FBI request, but independent nodes continued processing transactions.

Reopening withdrawals and the liquidity test

Binance is restoring withdrawals while the stolen funds remain in circulation. In a November 6 update, the exchange said it aimed to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of the following week.

Binance also reported replenishing 98% of the affected token assets by October 31. It pledged to cover customers’ losses, although replacing stolen assets does not mean recovering them.

The reopening has put Binance’s liquidity under pressure. Talos recorded $6.1 billion in net outflows. Bitcoin order-book depth within 1% fell 28% on the first day and reached a low around 44% below pre-hack levels near November 1 before recovering.

Bitcoin also dropped about 5% following the attack. However, Talos found limited signs of broader market contagion compared with the FTX collapse.

What it means for exchanges and compliance

The FBI attributed the theft to North Korea’s TraderTraitor group on October 31. It published addresses linked to the hackers and urged THORNode operators, DeFi services and instant exchanges to block related transactions.

Despite the sophisticated laundering, the attack began with familiar security weaknesses. Binance’s investigation described a fake job interview, malware installed on an engineer’s computer and the misuse of an internal AI tool. The attackers eventually gained access to systems involved in signing wallet transactions.

The breach highlights two challenges for exchanges: protecting employees and sensitive systems from intrusion, and stopping stolen funds from moving across decentralized networks.