Elliptic Traces $124M in Bitcoin Swaps From Binance Hack Funds

Elliptic Traces Binance Hack Laundering Trail

Blockchain intelligence firm Elliptic reported Wednesday that approximately $124M of assets stolen in the October Binance breach had been converted into Bitcoin, including funds originally held as XRP and Solana. In a November 6 update to its technical analysis, investigators detailed how the stolen capital shifted across multiple networks and tens of thousands of wallets.

The firm identified roughly 1,650 BTC sitting in newly created addresses following swaps from other digital assets. Stolen XRP valued at $50M began moving toward Bitcoin rails, while Solana tokens underwent bridging and mixing routines. Public on-chain data confirms the laundering operation remains active.

Cross-chain movement complicates forensic efforts because deposit and payout legs occur on different ledgers. Funds pass through aggregators and intermediary pools to obscure the source.

Frozen Balances Contrast With Cash-Out Totals

Elliptic reported that roughly $2.85B of the original stolen crypto assets had been frozen by checkpoint timestamps. Meanwhile, about $3.11B remained trapped in wallet clusters directly linked to the breach. Only a negligible portion of the overall loot appears converted into fiat currency so far.

Public addresses reveal coins shuffling between intermediate nodes without proving the real-world identities of the controllers. Criminal actors frequently hold large amounts of Bitcoin or Ether for extended periods before attempting liquidation through brokers or over-the-counter desks. Asset values fluctuate alongside broader market pricing.

Compliance Operations Face Persistent Monitoring Hurdle

Compliance services rely on address screening to alert businesses to sanctions exposure across cross-chain transfers. Automated risk scoring cannot replace manual forensic investigation when illicit funds cross complex network topologies.

Separately, Chainalysis disclosed an unrelated credentials issue involving its systems, prompting compliance operators to separate routine security audits from specific incident tracing. Future updates will depend on verified exchange freezes and attributed movements to identifiable liquidity venues.