Binance Hackers Convert $124M of Stolen Altcoins Into Bitcoin (BTC)

Laundering Spans 16 Blockchains

The effort to launder the $6.43 billion stolen from Binance now stretches across 16 blockchains, traced through more than 20,000 wallets and roughly 65,000 transactions, and its newest leg runs straight into spot Bitcoin markets. A blockchain forensics report published on November 6 shows the attackers have swapped $124 million of stolen altcoins for approximately 1,650 Bitcoin (BTC). That is a change of form, not a fresh loss: the swapped coins belong to the same hoard taken in the October 29 breach, and the conversion is reported separately from the $1.48 billion figure first attached to that attack. What the analytics describe as Bitcoin is the asset itself, not a wrapped Bitcoin representation on another chain, which places the proceeds inside the deepest pool of liquidity in the sector. The tracking puts $2.85 billion, 44.3% of the total, behind freezes, while $3.11 billion, 48.4%, still sits in connected wallets. Together those cover $5.96 billion of the $6.43 billion, leaving about $470 million, or 7.3% of the haul, unaccounted for in the published totals, a gap that timing differences and asset-value swings likely explain. Asset by asset, roughly $50 million in XRP has been moved so far and about $226 million remains in the attackers' wallets, while the stolen Solana, close to $87 million, is almost fully exchanged, bridged or cycled through transfers built to obscure its origin. The dispersion looks automated, though the analysis found no evidence that AI agents are directing it, and only a small share of the stolen money has actually been withdrawn to date.

Withdrawals Reopen With 98% Replenished

The concealment methods matter as much as the totals. Forensic work by TRM Labs documented self-minted tokens and liquidity pools on Tron created to disguise transfers, along with movements through lending receipt tokens and chained bridges that bypass wallets where assets could be frozen. A separate Chainalysis trace caught $325 million of stablecoins converting into $285 million of Ether inside 20 minutes, apparently to outrun freezes. Some XRP conversions routed through THORChain, a cross-chain network that operates like a decentralized atomic swap venue: its website blocked flagged addresses after an FBI request, yet independently operated nodes kept processing transactions. The published addresses tied to the case came with attribution, as the bureau linked the theft to North Korea's TraderTraitor group on October 31 and urged THORNode operators, DeFi services and instant exchangers to block related flows. Binance, meanwhile, is restoring withdrawals while the funds stay in motion, with a November 6 update listing HYPE, INJ, APT, PLASMA, NEAR and LTC for reopening by the end of the following week. Its official incident disclosure states that 98% of the affected token assets were replenished by October 31, with a pledge to cover customer losses in full, although replacing stolen assets is not the same as recovering them. Per the same account, the breach began with a fake job interview, malware installed on an engineer's computer and misuse of an internal AI tool, a route that bypassed technical perimeters rather than customer-facing KYC checks before reaching systems used to sign wallet transactions. The reopening lands on stressed liquidity: market-structure data from trading platform Talos recorded $6.1 billion in net outflows, order-book depth within 1% of mid price fell 28% on the first day and touched a low near 44% below pre-hack levels around November 1 before recovering, and the Bitcoin (BTC) price dropped about 5% after the attack. Even so, the same report found limited signs of broader contagion when set against the FTX collapse.

Only 7.3% of the Funds Lack a Trace

From a market standpoint, the move into Bitcoin (BTC) is a routing decision, not a supply shock. At 1,650 coins, the converted hoard is a rounding error beside Bitcoin's issuance schedule, which the halving cuts roughly in half every four years, and the 5% dip alongside a depth recovery suggests the sell-side pressure was absorbed. The draw of BTC for the attackers is exit liquidity: it is the deepest market in crypto, and freezes are harder to enforce there than on smaller chains. For a closer look at how stolen coins can be cornered after the fact, our report on Cory Fields' Bitcoin 'quantum landmines' documents one recovery path. What stays exposed, on the forensics' own accounting, is the $3.11 billion in connected wallets beyond direct freeze control, plus the $470 million, 7.3% of the haul, that the published totals do not cover. Dispersion across self-run infrastructure keeps that share mobile, and with only a small portion of the stolen funds actually withdrawn so far, the bulk of the risk remains inside crypto rails rather than beyond them.