Bitcoin (BTC): Binance Hackers Convert $124M to BTC

By Nodora News · 7 November 2026

Elliptic says Binance hackers swapped stolen tokens for about $124M in bitcoin — nearly double a day earlier — while $3.11B remains unmoved.

Blockchain analytics firm Elliptic said on November 6, 2026 that attackers behind the October 29 Binance theft — a record breach of roughly $6.43 billion that the FBI has attributed to North Korea’s TraderTraitor cluster (Pyongyang denies involvement) — have now converted about $124 million of other stolen assets into Bitcoin (BTC). That bitcoin pile is nearly double what Elliptic recorded a day earlier and includes a large run of XRP routed through THORChain.

Key takeaways

• About $124M (~1,650 BTC) has been converted from other stolen assets into bitcoin — nearly double the prior day’s total.
• Roughly $50M of XRP (~42M XRP) was swapped mostly into BTC via THORChain; about $226M of XRP (~192M XRP) remains.
• All stolen Solana (SOL) (~$87M) has been swapped, bridged or mixed, with much of it ending as BTC.
• About $3.11B still sits in addresses linked to the theft (mostly ETH and BTC); cash-out remains negligible.
• Roughly $2.85B has been frozen or seized (mostly stablecoins by Tether and Circle) — about 44% of the haul.
• The original 18,270 BTC split across 19 addresses on the day of the hack remains unmoved.

What Elliptic’s update shows

Elliptic’s Dr. Tom Robinson framed the November 6 note as a progress report on how the stolen stack is being reshaped rather than spent. The headline shift is bitcoin concentration: stolen altcoins and bridged value are being folded into BTC, while the largest original bitcoin and ether caches barely move.

On XRP, Elliptic said about $50 million (~42 million XRP) had been swapped, mostly into bitcoin, predominantly via THORChain. That still left roughly $226 million of XRP (~192 million XRP) in attacker-linked wallets. Separately, Elliptic said the entire stolen SOL book — about $87 million at the firm’s pricing — had been swapped, bridged or mixed, with a large share ending as BTC. That tracks Nodora’s earlier Solana follow-up, when on-chain desks said most of the stolen SOL had already left the original wallets via bridges and THORChain routes — see Solana (SOL): Binance Hackers Move 81% of Stolen SOL via THORChain.

An earlier Tron-heavy path of about $220 million in TRX had already shown how cross-chain hops were used to break heuristics; Nodora covered that corridor in TRON (TRX): Binance Hackers Launder $242M Through Cross-Chain Bridges. The November 6 Elliptic cut puts bitcoin, not TRX, at the center of the latest consolidation.

What has not moved

The stillness of the biggest piles is as important as the swaps. Elliptic said the original 18,270 BTC — split to 19 addresses on the day of the hack — had not been moved. Nine of the largest ether addresses, holding about 89% of the attackers’ ETH, had been quiet since October 30; only about $3 million of roughly $1.33 billion in ETH had been shifted.

In total, Elliptic put about $3.11 billion still in addresses linked to the theft, mostly ETH and BTC, with negligible cash-out so far. Against that, about $2.85 billion has been frozen or seized — chiefly stablecoins by Tether and Circle — or roughly 44% of the stolen value. That recovery/freeze layer was already central to Binance’s early incident narrative; Elliptic’s update keeps it in the ledger while stressing how much of the remaining risk is still sitting, not spending. For the original breach timeline and FBI attribution, see Binance Hit by Record $6.3 Billion Hack Linked to North Korea.

How the laundering looks

Elliptic described the operational graph as automated and sprawling: more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000-plus transactions — on the order of one new wallet every 30 seconds. Privacy tooling showed up at the edges: Wasabi-style coinjoins totaling about 33 BTC, and a Privacy Cash path of roughly $1.1 million in ETH and SOL that was paused briefly. Elliptic said the pattern looks automated but found no evidence of AI-agent decision-making in the laundering itself.

Looking ahead, Elliptic expects more of the familiar post-theft playbook seen after large North Korea–linked jobs such as Bybit: small ETH-to-BTC batches, then OTC desks and Chinese money-laundering networks stretched over months rather than a single dump. That framing treats the current $124M BTC conversion as an intermediate consolidation step, not the end state.

Binance recovery track and market tape

Separately from Elliptic’s forensics, Binance has said it aims to reopen withdrawals for additional pairs including HYPE, INJ, APT, PLASMA, NEAR and LTC by the end of next week, with all tokens on networks that have already been restored. That sits on top of the exchange’s earlier Recovery Update that reopened dozens of pairs across restored networks — covered in Binance (BNB) Reopens Withdrawals for 58 More Token Pairs.

At about 05:53 AEDT on November 7, 2026 on OKX, BTC last traded near $75,851 (about −0.5% over 24 hours), ETH near $2,233 (−0.9%), XRP near $1.187 (−4.0%), SOL near $90.31 (+0.6%) and BNB near $695 (+0.2%). Live BTC and peer charts are on Nodora’s charts page.

What to watch next

Watch whether the remaining XRP book follows the same THORChain-to-BTC path, whether the parked 18,270 BTC or the large ETH clusters finally chip, and how fast Binance restores the next withdrawal tranche. Also watch for more freezes from stablecoin issuers or exchange compliance desks if any consolidated BTC hits known on-ramps. None of this is financial advice; it is a forensics update on a still-active laundering campaign after the largest exchange theft on record.

#Bitcoin #BTC #Binance #Elliptic #laundering

This article is general information, not financial advice.