Hackers behind the $6.43 billion Binance breach have swapped approximately $124 million in stolen altcoins into bitcoin through a sprawling laundering operation spanning 20,000 wallets across 16 blockchains, according to blockchain analytics firm Elliptic. The exchange plans to reopen withdrawals for multiple tokens by end of next week.
Key Takeaways
- Hackers converted $124M in altcoins to bitcoin via 65,000 transactions across 20,000 wallets and 16 blockchains
- XRP largest swapped portion at $50M via THORChain; nearly all SOL already bridged to bitcoin
- $3.11B remains traceable in attack-linked addresses; $2.85B frozen; $470M unaccounted
- North Korean attribution confirmed; AI agent laundering speculation rejected by Elliptic
- Binance targets withdrawal reopenings for 6+ tokens and 4 networks by end of next week
Executive Intelligence Brief
Laundering Mechanics and Cross-Chain Flows
Elliptic's update reveals the attackers have executed 65,000 transactions to obfuscate fund origins, with the largest converted portion coming from stolen XRP swapped through THORChain. By early Friday, roughly $50 million in XRP had been converted primarily into bitcoin, leaving approximately $226 million in XRP remaining. Nearly all stolen Solana (SOL) has already been mixed, swapped, or bridged into bitcoin.
Despite the transaction volume, Elliptic estimates only a "negligible amount" has likely been cashed out. The firm expects attackers to swap remaining ether for bitcoin in small batches before attempting cash-out through OTC brokers and Chinese money laundering networks.
Attack Attribution and Vector Analysis
The breach, attributed to North Korean actors, resulted in $1.48 billion in bitcoin stolen directly alongside altcoin holdings. Binance's own Tuesday report detailed a months-long operation involving a tampered developer tool, a fake job interview, and compromised internal AI tooling that granted attackers access to the exchange's wallet-signing infrastructure. Elliptic explicitly rejected speculation that AI agents were autonomously directing the laundering, stating the process is automated but shows no evidence of AI decision-making.
Asset Recovery and Exchange Solvency
Of the $6.43 billion total stolen, approximately $3.11 billion remains in addresses linked to the attack, mostly in ether and bitcoin, while $2.85 billion has been frozen. A $470 million discrepancy remains unexplained, potentially reflecting price volatility since the breach, funds already cashed out, or both. Binance has since replenished virtually all stolen assets, maintaining operational solvency.
Operational Recovery and Withdrawal Roadmap
On Friday, Binance announced plans to reopen withdrawals for HYPE, INJ, APT, PLASMA, NEAR, and LTC by end of next week, alongside all tokens on networks already restored including Ethereum, BSC, Arbitrum, and Optimism. The phased reopening signals confidence in containment while the laundering operation continues across decentralized infrastructure.
