Elliptic says Binance hackers swapped stolen tokens for $124M in bitcoin, exchange plans more withdrawal reopenings
The attackers in last week's $6.43 billion breach of the Binance crypto exchange have managed to swap around $124 million in altcoins into bitcoin, according to an update from blockchain analysis firm Elliptic.This is on top of the $1.48 billion in bitcoin stolen in the attack, which is being attributed to North Korea.Elliptic added that the laundering operation has thus far used more than 20,000 wallets across 16 blockchains and 65,000 transactions, in an attempt to obfuscate the source of the funds. Despite this, the firm estimated that only a "negligible amount" has likely been cashed out.The largest portion of the converted bitcoin came from stolen XRP swapped through THORChain. Elliptic's report said that by early Friday, roughly $50 million in XRP had been swapped, primarily into bitcoin, with about $226 million remaining.The report added that nearly all of the stolen Solana (SOL) has already been mixed, swapped, or bridged into bitcoin.Around $3.11 billion, mostly in ether and bitcoin, remains in addresses linked to the attack, while $2.85 billion of the total $6.43 billion has been frozen. It's unclear if the $470 million not accounted for here is due to price changes since the attack, is from funds that have already been cashed out, or is a mix of both.The Block has reached out to the report's author, Tom Robinson, for clarification.Elliptic wrote that it expects the attackers to swap the rest of the ether for bitcoin in small batches before trying to cash it out through OTC brokers and Chinese money laundering networks.The firm also rejected the speculation that AI agents were doing the laundering."The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," Elliptic said.Binance withdrawal reopeningsOn Friday, Binance wrote on X that it was working to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by the "end of next week." It is also aiming to reopen withdrawals "for all tokens on networks that are already restored," including ETH, BSC, Arbitrum and Optimism.The exchange's own report, published Tuesday, said the attack was carried out over months and involved a tampered developer tool, a fake job interview and compromised internal AI tooling that got the attackers access to Binance's wallet-signing infrastructure.Binance has since replenished virtually all the assets stolen in the breach.