Assets stolen from Binance have increasingly been converted into bitcoin as the operators behind the October 29 theft continue a multichain laundering campaign, according to a November 7 update from blockchain analytics firm Elliptic. The firm said roughly 2,300 BTC, worth about $175 million at its snapshot, sat in newly created bitcoin addresses after conversions from other stolen cryptocurrencies.

What changed in the latest snapshot

Elliptic's data through 08:00 UTC on November 7 showed the converted bitcoin total rising from about 1,650 BTC a day earlier. The latest increase followed faster movement of stolen XRP: the firm said another 44 million XRP, valued at roughly $51 million, left theft-linked addresses overnight, with most swapped through THORChain into bitcoin. About 148 million XRP remained in the tracked addresses.

Related reporting: Elliptic Traces Stolen Binance TRX Through Six Bridges

Other assets followed the same route

The tracing report said all of the approximately $90 million in stolen SOL had been swapped, bridged or mixed, with much of it ending as bitcoin. It also tracked TRX through bridges and swap services, smaller ETH conversions and about 412,000 NEAR leaving a main account in small batches. Some sequences crossed four blockchains within hours, illustrating how a single asset trail can fragment across several networks and services.

Mixing increased, but the main holdings stayed still

Elliptic said about 53 BTC entered Wasabi-style coinjoins overnight, bringing the cumulative total mixed through that method to roughly 88 BTC, or $6.7 million. Coinjoins combine inputs from multiple users and make direct transaction links harder to follow. However, the report said the largest theft-linked bitcoin and ether holdings had not moved by the cut-off time.

Conversion is not cash-out

The distinction matters for assessing recovery and enforcement. Swapping XRP, SOL or other tokens into bitcoin changes the asset and can complicate screening, but the resulting coins remain visible on public blockchains. Elliptic estimated that only a negligible amount had likely been cashed out. Turning the holdings into usable fiat currency would generally require a centralized exchange, broker or other counterparty, creating another opportunity for compliance controls or law-enforcement action.

The figures remain time-specific estimates

Bitcoin.com independently reported the 2,300 BTC estimate but noted that Arkham Intelligence's labeled attacker balance did not show a matching increase. That does not necessarily invalidate Elliptic's count because newly created conversion addresses may sit outside Arkham's original wallet label, yet it highlights that attribution methods and cut-off times can produce different totals. Elliptic itself uses the phrase 'the attacker' for the controller of the observed wallets and says on-chain data cannot identify who currently possesses funds that may have been handed to intermediaries.

What compliance teams are watching

Elliptic said around $3.13 billion remained in addresses linked to the theft, while $2.85 billion had been frozen. The most actionable points may come when funds briefly enter freezeable stablecoins or reach centralized services for cash-out. The firm expects the main ether holdings to be converted into bitcoin in smaller batches over time, but that is a forecast based on prior cases rather than confirmation of the attackers' next move.

What remains uncertain

The update does not establish how much will ultimately be recovered, whether additional services will block transactions or when any large untouched holdings will move. It does show that the laundering pattern has shifted from the early scramble to escape stablecoin freezes toward a longer process of cross-chain conversion, mixing and possible future cash-out. Every balance in the report should therefore be read as a snapshot, not a final accounting.

Sources

AI-generated editorial image; not a photograph of the reported event. Prepared with AI assistance and source verification.