Attackers behind the theft of about $6.43bn in crypto assets from Binance have converted roughly $124m of stolen alternative tokens into bitcoin, according to the blockchain analysis firm Elliptic. The firm said on 6 November that the conversions amounted to about 1,650 coins and came on top of the $1.48bn of bitcoin taken in the breach itself, which ran across 29 and 30 October.
Elliptic’s tracing places the activity across more than 20,000 wallets on 16 separate blockchains, spread over about 65,000 transactions. About $3.11bn of the proceeds, mostly ether and bitcoin, remains in addresses the firm has linked to the attack. A further $2.85bn of the $6.43bn has been frozen by parties able to hold or block the assets, so the two figures together account for about $5.96bn of the total.
What has been frozen
By early on 6 November, about $50m of stolen XRP had been converted, with roughly $226m of XRP still sitting in linked addresses, the firm said. Elliptic added that only a negligible share of the total had probably been cashed out, the step that would put the money beyond the reach of recovery efforts. It also rejected speculation that autonomous AI agents were directing the laundering.
Freezing is the lever that has worked, and it depends on cooperation from parties able to refuse to move or convert an asset once it has been identified. That makes the frozen share a measure of how quickly exchanges and issuers responded rather than of how much the attackers got wrong. What it does not show is how much of the rest can be recovered, which turns on the same cooperation holding as the assets begin to move.
Frozen is not the same as returned. An asset held by an exchange or blocked by an issuer stays where it is, and getting it back to customers depends on the institution holding it and on the legal process that follows. The firm’s figures describe where value sits, not who will end up with it.
Set against the $6.43bn total, the value converted so far is a small fraction, which is consistent with the finding that only a negligible amount has been cashed out. It leaves the great majority of the theft either frozen or resting in addresses under observation, with the question of recovery still open.
The firm has attributed the breach to attackers linked to North Korea. That attribution is an assessment drawn from the transaction trail it has mapped, not a finding by any court, and no individual has been publicly identified in connection with the theft.
Customers wait for withdrawals
Binance said it aims to reopen withdrawals for several more tokens by the end of next week: HYPE, INJ, APT, PLASMA, NEAR and LTC. The exchange has not said what proportion of customer balances those tokens represent, and holders of the affected assets remain unable to move them in the meantime.
The numbers make this the largest single test so far of whether exchanges, stablecoin issuers and chain analysts can stop a multibillion dollar theft before it reaches cash. Conversion into bitcoin matters because bitcoin is the most liquid asset in the market and the easiest to move between venues, which is why the trace follows it as a staging step rather than an endpoint.
For customers, the immediate test is the staged reopening of withdrawals, token by token, and whether balances arrive intact. For regulators and for the firms doing the blocking, the unresolved question is what becomes of the $3.11bn still sitting in linked addresses, and how long the present level of cooperation can be sustained.
