Binance Theft: $124M Moves Into Bitcoin While Billions Remain Immobilized
What happened: Elliptic said on November 6 that attackers behind the $6.
What happened: Elliptic said on November 6 that attackers behind the $6.43 billion Binance hot-wallet theft had swapped $124 million in stolen altcoins into bitcoin, including approximately $50 million in XRP routed through THORChain. The attack began on October 29; Elliptic reported that $2.85 billion had been frozen and approximately $3.11 billion, mostly in ETH and BTC, remained in attacker-controlled addresses. Binance said it planned further withdrawal restorations by the end of the week, including HYPE, INJ, APT, PLASMA, NEAR and LTC, alongside tokens on several networks.
Why it matters: The important distinction is between converting stolen assets and successfully cashing them out: Elliptic assessed that little had likely reached that final stage. Its tracking covered more than 20,000 wallets, 16 blockchains and 65,000 transactions, illustrating the operational complexity facing investigators even when substantial funds remain traceable or frozen. Elliptic described the activity as automated but explicitly rejected speculation that AI agents were directing laundering decisions; transaction repetition supports an automation claim, not a conclusion about autonomous reasoning.