Elliptic traces $124M in Binance hack funds converted to Bitcoin
TL;DR: Elliptic’s November 6 analysis: approximately $124 million from the October Binance theft has been converted into Bitcoin, including funds initially held as XRP and SOL. Onchain tracing tracks movements across wallets and chains but does not identify all controllers or prove cash-out.
Cross-chain movement and current holdings
Elliptic’s tracing spans tens of thousands of wallets across multiple networks and services. By November 6, analysts identified about 1,650 BTC in newly created addresses after conversions from other stolen assets. Around $50 million in XRP had begun moving into Bitcoin. Stolen Solana tokens were swapped, bridged, or mixed. The investigation is ongoing: estimates are tied to specific timestamps and may change as transactions progress and wallet clusters update.
Cross-chain transfers complicate tracing when deposits and payouts occur on different networks or route through pools, aggregators, and intermediaries. Public ledgers and linkages to known services still enable partial reconstruction of flows.
Conversion versus cash-out
Elliptic reported approximately $2.85 billion frozen and about $3.11 billion still in addresses linked to the theft at the latest checkpoint. Only a negligible portion appears to have been cashed out. These figures can shift with new tracing and with market price changes. Holding large positions in Bitcoin or Ether does not equal liquidation through brokers or exchanges. Public addresses show coin movement but generally do not prove the real-world identity of controllers or final ownership.
Compliance services use attributed addresses to flag sanctions and illicit exposure across networks. Blacklists and automated risk scores require investigation and human judgment to assess actual risk.
Separate incident and infrastructure risk
A different security incident affected Chainalysis and was described as unrelated to the Binance theft. Elliptic’s work pertains to tracing funds from the exchange breach. Operators should prioritize custody controls, counterparty risk management, and incident response, not rely solely on single-chain explorers.
Further meaningful updates: verified freezes, movements to identifiable services, and evidence of cash-out. Elliptic’s data indicates continued complex fund routing without confirmation of ultimate recipients or recovery levels.
Written by News Desk, edited by Samuel Rae.
Authors credited by the source: NewsBTC Editorial Team
Published by Holder based on an external source.
