How Did Binance Hackers Turn Stolen Altcoins Into 2,300 BTC?

The Oct. 29, 2026, Binance hack stands as the largest cryptocurrency exchange breach in U.S. dollar terms, with the attackers making off with an extraordinary haul. Last week, Bitcoin.com News detailed how the perpetrators siphoned 18,270.2 BTC from the trading platform, while onchain records and blockchain forensic analysts now indicate that their bitcoin stockpile is growing considerably larger.

This week, Elliptic co-founder and chief scientist Dr. Tom Robinson published a detailed examination of the incident, incorporating updates through Saturday, Nov. 7, 2026. Robinson’s findings reveal that altcoins stolen during the Binance breach have since been converted into approximately 2,300 BTC, valued at $175 million based on bitcoin prices as of Nov. 7.

“The laundering is highly complex and clearly automated,” Robinson’s report details. “Since the theft it has used more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. That is roughly one new wallet every 30 seconds and one transaction every 10 seconds.”

From Solana to Bitcoin, a Multichain Laundering Operation

The Elliptic co-founder detailed how the attackers transferred approximately $90 million in stolen solana (SOL), with much of the proceeds ultimately converted into bitcoin. XRP also emerged as a substantial contributor to the attackers’ expanding bitcoin holdings, while stolen tron (TRX) was similarly exchanged for BTC.

Ethereum (ETH) accounted for a smaller portion of the conversions, while the attackers also employed Thorchain to facilitate cross-chain asset swaps. Throughout Robinson’s analysis, the Elliptic boss repeatedly ties the hackers to North Korea, and the country is mentioned eight times.

How Are the Hackers Obscuring Their Bitcoin Trail?

A portion of the newly acquired bitcoin subsequently flowed through Wasabi Wallet coinjoins, a transaction technique that commingles bitcoin from multiple participants to complicate blockchain tracing efforts. By Nov. 7, Robinson’s analysis indicated that approximately 88 BTC, valued at $6.7 million, had been processed through this obfuscation method.

The Elliptic co-founder further noted:

“On NEAR, approximately 412,000 NEAR ($1.5 million) left the main accounts in small batches. In total, roughly 2,300 BTC ($175 million) now sit in newly created bitcoin addresses following conversions from other stolen cryptocurrencies. Meanwhile, the primary bitcoin and ETH holdings remain untouched.”

At the same time, data gathered by Bitcoin.com News from blockchain analytics platform Arkham Intelligence paints a somewhat different picture, showing no corresponding addition of 2,300 BTC, although the original 18,270.2 BTC attributed to the attackers had climbed to 18,384.725 BTC as of 10 a.m. ET on Nov. 7, 2026.

Arkham’s transaction records nevertheless reveal bitcoin deposits originating from Thorchain vaults on Saturday, alongside TRX token swaps executed through Sun.io, a prominent decentralized finance (DeFi) protocol operating on the Tron network.