Hackers behind the Oct. 29, 2026, Binance breach have converted $175 million in stolen altcoins into approximately 2,300 BTC, expanding their bitcoin reserves beyond the initial 18,270.2 BTC haul valued at $6.3 billion.
Dr. Tom Robinson, co-founder and chief scientist at on-chain intelligence firm Elliptic, documented the laundering operation through Nov. 7, 2026. Robinson's analysis describes the process as "highly complex and clearly automated," employing more than 20,000 wallets across 16 blockchains and at least 36 distinct services.
Since the theft, attackers executed approximately 65,000 transactions—establishing roughly one new wallet every 30 seconds and one transaction every 10 seconds.
The conversion centered on stolen Solana (SOL). Approximately $90 million in SOL moved through exchanges into bitcoin. XRP and Tron (TRX) also funneled into bitcoin holdings through similar routes. Ethereum (ETH) accounted for a smaller portion. Attackers leveraged Thorchain to swap assets fluidly across chains.
Elliptic's analysis attributes the breach to North Korea, consistent with patterns in large-scale cryptocurrency thefts.
To obscure the trail, attackers processed approximately 88 BTC through Wasabi Wallet coinjoins—valued at $6.7 million at current bitcoin prices of $75,680. This method commingles bitcoin from multiple participants to complicate chain analysis.
On the NEAR blockchain, approximately 412,000 NEAR tokens valued at $1.5 million transferred in small batches from main accounts, demonstrating diversified dispersal tactics.
The newly acquired 2,300 BTC now sits in freshly created bitcoin addresses. Elliptic's data shows the primary bitcoin and ETH holdings from the original $6.3 billion breach remain untouched in their initial wallets.
Blockchain analytics platform Arkham Intelligence presents a conflicting view: it shows no corresponding addition of 2,300 BTC to attacker wallets it tracks, though it confirms attribution of the original 18,270.2 BTC to the perpetrators.
