Binance Hackers Move Stolen Funds Across 20,000 Wallets and 16 Blockchains

Highlights:

• Elliptic says Binance hackers used more than 20,000 wallets across 16 blockchains to move stolen funds.
• About $2.85 billion has been frozen, while $3.13 billion remains in addresses connected to the theft.
• Attackers converted $175 million into Bitcoin, although Elliptic believes little stolen crypto has been cashed out.

Blockchain analytics firm Elliptic says the hackers behind Binance’s $6.43 billion theft have moved stolen funds through more than 20,000 wallets across 16 blockchains. The operation has involved at least 65,000 transactions and 36 services, including crypto bridges, decentralized exchanges, and lending platforms. Despite the extensive transfers, Elliptic believes very little of the stolen cryptocurrency has been cashed out so far.

In a report published on November 3 and updated on November 7, Elliptic detailed how the attackers have moved the funds since the October 29 breach. The firm found that much of the activity follows automated patterns, allowing the hackers to spread assets across thousands of addresses.

The Binance hackers have swapped about $175 million in stolen altcoins into roughly 2,300 bitcoin, according to Elliptic.

The laundering spans 16 blockchains, more than 20,000 wallets and 65,000 transactions. Elliptic's count was $124 million a day earlier.

— TFTC (@TFTC21) November 7, 2026

Binance Hackers Use Thousands of Wallets to Move Stolen Funds

According to Elliptic, the attackers used several methods to move the stolen cryptocurrency and make the transactions harder to trace. They split large amounts into smaller transfers and moved funds between blockchains using bridges and decentralized exchanges. Some transactions also passed through lending protocols and mixing services, making it harder to follow the money.

The Tron network handled a large share of the early activity. The hackers spread funds across roughly 7,700 addresses before moving much of the cryptocurrency to Ethereum and other networks. Elliptic also found signs of automation. At one point, wallets on Tron processed around 1,300 transactions in a single hour. However, the firm found no evidence that artificial intelligence agents were making the decisions.

Hackers Convert $175 Million in Stolen Crypto Into Bitcoin

The attackers have also started converting stolen assets into Bitcoin. By November 7, around $175 million worth of cryptocurrency had been converted into approximately 2,300 BTC. Elliptic said the funds came from several stolen assets, including SOL, XRP, TRX, and ETH.

All of the roughly $90 million in stolen Solana tokens had been transferred, swapped, or mixed. Meanwhile, the hackers had converted about $100 million worth of XRP, mostly into Bitcoin, leaving approximately $173 million in XRP addresses linked to the theft.

Some transfers passed through four different blockchains within hours. The attackers also used privacy tools to make certain transactions more difficult to track. However, Elliptic said these conversions do not mean the hackers have successfully cashed out the money.

Binance Hackers Still Hold $3.13 Billion in Stolen Crypto

Despite the laundering activity, a large portion of the stolen cryptocurrency has not moved. Elliptic reported that approximately $2.85 billion of the stolen assets had been frozen or seized. Another $3.13 billion remained in addresses connected to the attack, mainly in Bitcoin and Ethereum.

The hackers have left the main Bitcoin holdings and most of the stolen ETH untouched. Elliptic believes those funds are still likely under North Korean control. The FBI previously attributed the October 29 attack to North Korea’s TraderTraitor hacking group.

Looking ahead, Elliptic expects the attackers to convert more of the stolen ETH into Bitcoin before attempting to cash out through over-the-counter brokers and centralized exchanges. The firm pointed to the 2025 Bybit hack, when stolen ETH was converted into Bitcoin before the funds were gradually cashed out over several months.

For now, the stolen Binance assets remain either frozen or traceable on public blockchains. However, the attackers could continue moving funds in smaller amounts over the coming months.