Hackers linked to Binance’s massive cryptocurrency breach continue moving stolen assets as the exchange gradually restores customer withdrawals.
The attackers have shifted substantial altcoin holdings into Bitcoin while investigators track transactions across multiple blockchain networks.
Meanwhile, Binance faces fresh liquidity challenges as customers regain access to affected cryptocurrencies. Blockchain analysts say the transfers highlight ongoing difficulties in tracing stolen funds and preventing their movement through decentralized services.
Binance hackers convert $124M in stolen Altcoins into Bitcoin
According to Elliptic’s November 6 report, hackers converted approximately $124 million in stolen altcoins into 1,650 Bitcoin.
The transfers followed the October 29 attack, which reportedly involved $6.43 billion in stolen cryptocurrency.
Elliptic distinguished the latest conversions from an earlier $1.48 billion movement linked to the breach.
Investigators tracked approximately $50 million in XRP transfers, while another $226 million remained in hacker-controlled wallets.
Meanwhile, attackers moved nearly all the stolen Solana, worth approximately $87 million, through swaps, cross-chain transfers, and obfuscation transactions.
Elliptic estimated that authorities and platforms had frozen $2.85 billion, representing 44.3% of the stolen assets.
Another $3.11 billion, or 48.4%, remained in connected wallets.
However, those figures account for only $5.96 billion of the reported $6.43 billion theft.
The remaining $470 million, approximately 7.3%, falls outside those totals, potentially reflecting valuation differences or reporting periods.
Elliptic also noted that hackers had withdrawn only a small portion of the stolen funds. The Bitcoin conversions represented asset exchanges rather than additional thefts or direct cash withdrawals.
Blockchain investigators track complex laundering operations
Elliptic identified more than 20,000 wallets across 16 blockchains and approximately 65,000 transactions linked to the laundering activity.
The transaction patterns suggested automation, although investigators found no evidence that AI agents controlled the transfers.
TRM Labs reported that hackers created tokens and liquidity pools on Tron to disguise fund movements.
The attackers also used lending receipt tokens and blockchain bridges to bypass wallets vulnerable to asset freezes.
Separately, Chainalysis tracked hackers converting $325 million in stablecoins into $285 million worth of Ether within 20 minutes.
Investigators linked those rapid conversions to efforts to avoid freezes.
Some XRP transfers also passed through THORChain. Its website blocked flagged addresses following an FBI request, but independent nodes continued processing transactions.
On October 31, the FBI attributed the breach to North Korea’s TraderTraitor group.
The agency published associated wallet addresses and urged THORNode operators, decentralized services, and instant exchanges to restrict related transactions.
Binance restores withdrawals as liquidity faces pressure
Binance continued restoring withdrawal services despite ongoing movements of stolen cryptocurrency.
In its November 6 update, Binance targeted the following week’s end for reopening HYPE, INJ, APT, PLASMA, NEAR, and LTC withdrawals.
The exchange said it had replenished 98% of affected token assets by October 31 and pledged to cover customer losses.
However, replenishing reserves does not necessarily mean recovering stolen funds.
Talos recorded $6.1 billion in net outflows as Binance faced mounting liquidity pressure.
Bitcoin order-book depth within 1% dropped 28% on the first day. Around November 1, liquidity reached approximately 44% below pre-attack levels before recovering.
Bitcoin also declined roughly 5% following the breach, although Talos found limited evidence of wider market contagion compared with FTX’s collapse.
Binance’s investigation linked the intrusion to a fraudulent job interview, malware on an engineer’s computer, and misuse of an internal AI tool.
The attackers subsequently accessed systems responsible for signing wallet transactions.
The findings underscore the security and compliance challenges exchanges face as stolen cryptocurrency moves across interconnected blockchain networks.
The post Binance hackers move $124M into Bitcoin as exchange restores crypto withdrawals first appeared on Coinfea.