Binance Hackers Keep Laundering, Stack 2,300 More Bitcoin: Elliptic

The Binance hackers aren't sitting on their loot — they're busy converting it. Elliptic, the blockchain analytics firm, says the attackers behind the Oct. 29, 2026 breach have swapped $175 million in stolen altcoins into roughly 2,300 BTC, according to a report from co-founder and chief scientist Dr. Tom Robinson covering activity through Saturday, Nov. 7, 2026.

The original heist remains the biggest crypto exchange breach ever measured in dollar terms: 18,270.2 BTC drained from Binance's wallet, a haul worth about $6.3 billion. Now the stolen bitcoin pile is metastasizing, and the laundering operation behind it looks less like a person and more like a machine.

Robinson's numbers are staggering. Since the theft, the attackers have bounced funds across more than 20,000 wallets on 16 blockchains, touching at least 36 services and racking up at least 65,000 transactions. That works out to roughly one fresh wallet every 30 seconds and a transaction every 10 seconds, he noted, calling the laundering “highly complex and clearly automated.”

Where's the money coming from? About $90 million in stolen solana (SOL) got moved, with much of it eventually flipped into bitcoin. XRP pitched in heavily too, and stolen tron (TRX) was also exchanged for BTC. Ethereum (ETH) made up a smaller slice, and the crew leaned on Thorchain for cross-chain swaps. Robinson repeatedly pins the operation on North Korea, naming the country eight times in his analysis.

Some of the newly acquired bitcoin then ran through Wasabi Wallet coinjoins, a mixing trick that blurs the trail between participants. By Nov. 7, Robinson tallied about 88 BTC — $6.7 million — through that method. On NEAR, roughly 412,000 NEAR ($1.5 million) slipped out of the main accounts in small batches. The report says about 2,300 BTC now sits in freshly created bitcoin addresses, while the primary bitcoin and ETH holdings stay untouched.

Not everyone sees the same picture. Data pulled by Bitcoin.com News from Arkham Intelligence shows no matching 2,300 BTC addition — though the original 18,270.2 BTC tied to the attackers had grown, sitting at 18,384.725 BTC as of 10 a.m. ET on Nov. 7, 2026. Arkham's records do show bitcoin deposits flowing out of Thorchain vaults on Saturday, plus TRX token swaps routed through Sun.io, a DeFi protocol on Tron.