TL;DR: A November 6 update from blockchain intelligence firm Elliptic says roughly $124 million of assets stolen in the October Binance breach had been converted into Bitcoin, including funds originally held as XRP and SOL. Onchain tracing can reveal movement, but it cannot by itself identify every person controlling those wallets or prove that all the converted funds have been cashed out.
The laundering trail from the huge October cryptocurrency theft attributed by investigators to North Korean-linked actors continues to evolve. In a November 6 update to its technical analysis, Elliptic said the value of stolen assets converted into Bitcoin had reached approximately $124 million.
The headline figure is striking, but the more useful story concerns how the funds moved, what remains traceable and why conversion into Bitcoin is not the same as spending money through the conventional financial system.
The route cuts across multiple blockchains
Elliptic’s investigation describes activity involving tens of thousands of wallets, multiple networks and an assortment of services. By its November 6 checkpoint, analysts had identified about 1,650 BTC held in new addresses following conversion from other stolen assets. The firm said roughly $50 million worth of XRP had begun moving largely towards Bitcoin, while stolen Solana tokens had also been swapped, bridged or mixed.
The firm presented this as an ongoing, rapidly changing investigation. An estimated figure tied to a timestamp should not be reported as a permanent total, and wallet clusters can change as further transactions occur.
Cross-chain movement complicates tracing because the deposit and payout sides of a transfer may occur on different networks. It can also make the trail harder to follow when funds pass through pools, aggregators and intermediaries. However, the public nature of blockchain transactions and the ability to connect wallet activity through known services can still help investigators reconstruct substantial portions of the flow.
Converting stolen crypto is not the same as cashing out
Elliptic reported that approximately $2.85 billion of the original stolen assets had been frozen and about $3.11 billion remained in addresses linked to the theft at its latest checkpoint. The firm cautioned that only a negligible portion appeared to have been cashed out. Such estimates may change with later tracing, and asset values vary with market prices.
This matters because a criminal actor may hold large amounts of Bitcoin or Ether for some time before attempting to move value through brokers or exchanges. Public addresses can show coins being shuffled, but they generally cannot prove the real-world identity of each subsequent controller or the final ownership arrangement.
The distinction is especially relevant to compliance services. Screening against attributed addresses can alert businesses to potential sanctions or illicit-funds exposure, even when the funds have crossed networks. Yet address blacklists and automated risk scoring are not perfect substitutes for investigation and human judgement.
A separate warning about infrastructure dependencies
The evolving theft occurred alongside a different security incident affecting Chainalysis, another blockchain-analysis provider. The two incidents should not be conflated. Chainalysis described its own systems and credentials issue as unrelated to the Binance theft, while Elliptic’s work here concerns tracing funds from that separate exchange incident.
For operators, the lesson connects to the custody, counterparty and incident-response themes covered in NewsBTC’s reporting on digital-asset infrastructure restrictions. Protecting users involves controls over withdrawals, counterparties and incident communications — not simply watching one chain’s transaction explorer.
The next meaningful updates will concern verified freezes, attributed movements to identifiable services and evidence of actual cash-out. Elliptic’s data show the stolen funds are still moving through complex paths. They do not yet tell a complete story about who ultimately receives them or how much can be recovered.
This article was written by the News Desk and edited by Samuel Rae.
