Attackers behind the Binance hack converted $175 million in stolen altcoins into roughly 2,300 BTC, according to blockchain analytics firm Elliptic. The November 7 report detailed how the hackers exchanged previously stolen assets across 20,000 wallets on 16 blockchains, involving 36 services and 65,000 transactions. The operation was heavily automated, with new wallets created every 30 seconds and transactions occurring every 10 seconds. Stolen altcoins like SOL, XRP, and TRX were swapped into Bitcoin, with $90 million in SOL moving through various services.
Elliptic tracked about 88 BTC entering coinjoins, which obscure transaction trails. Meanwhile, Arkham’s labeled balance showed a much smaller increase, with 114.525 BTC added to its entity wallets, far below Elliptic’s 2,300 BTC estimate. The discrepancy remains unresolved, as the reports cover different aspects of the stolen funds. Binance attributed the hack to North Korea and reported that 98% of impacted assets had been replenished by October 31.
Binance identified unauthorized access to an internal wallet signing service, linked to compromised employee devices and malware. The exchange closed the entry points, rebuilt affected systems, and implemented stricter controls. As of November 3, Binance estimated the affected assets at $6.34 billion, with $2.85 billion in frozen or intercepted assets. The company assured it had sufficient funds to cover the financial impact.