Attackers behind the October 29 Binance hack have converted about USD 124 million in stolen tokens into Bitcoin, according to blockchain analytics firm Elliptic. Binance is gradually reopening withdrawals, while a separate Polygon proposal seeks to recover tokens linked to the breach.
Elliptic reported on November 6 that stolen altcoins had yielded about 1,650 BTC. This comes separately from the 18,270 BTC taken directly in the attack. Its investigators traced more than 65,000 transactions involving over 20,000 wallets across 16 blockchains and at least 36 services.
About USD 50 million in XRP had been swapped, mostly into Bitcoin through THORChain, while another USD 226 million remained. The attackers also moved nearly all the stolen Solana, worth about USD 87 million, through swaps, blockchain bridges or mixing services.
Elliptic estimated that USD 3.11 billion remained in addresses linked to the theft, mainly in Bitcoin and Ether. Another USD 2.85 billion had been frozen or seized. The firm said a “negligible amount” had likely been cashed out, distinguishing token swaps from sales for spendable funds.
TRM Labs separately identified newly minted tokens and lending receipt tokens on Tron among the routes used to move stolen funds between wallets. Its analysis also described cross-chain transfers that concealed direct links between some sending and receiving addresses. The firm traced those routes across Tron and Ethereum.
Elliptic also addressed speculation that artificial intelligence was directing the transactions. “The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions,” it said. The FBI attributed the October 29 theft to North Korea's TraderTraitor group.
Binance announced another phase of withdrawals on November 6, starting at 04:00 UTC. The exchange said it would restore access to each token and network only after completing security checks. Deposits remain open, but customers may experience processing delays during the phased reopening.
It aims to resume withdrawals for HYPE, INJ, APT, PLASMA, NEAR and LTC by November 13. Binance also plans to restore withdrawals for all supported tokens on networks already reopened, including Ethereum, BNB Smart Chain, Polygon, Arbitrum and Optimism. The exchange has not guaranteed that every target will be met.
In its November 3 incident report, Binance said attackers used fake recruitment interviews, infected developer software and compromised internal AI tools to gain access to wallet-signing systems. That account concerns the break-in, not Elliptic's separate assessment of the laundering.
Binance put the value affected by the theft at approximately USD 6.34 billion, compared with Elliptic's USD 6.43 billion estimate. It said it had replenished 98% of affected token assets by October 31 and would cover the losses using its own resources.
Meanwhile, a proposal published on Polygon's community forum on November 4 calls for a hard fork to return 70.49 million POL held in five blocked addresses. The proposal links about 46.63 million POL to Binance and 23.86 million to a separate Polymarket security incident.
Polygon block producers have restricted transfers from the addresses, but the tokens have not returned to the affected platforms. The proposed fork would move their balances to designated recovery wallets through a coordinated network change.
The proposal describes the measure as “an extreme action that should not be reproduced commonly.” It requires governance approval, testing and confirmation of the recovery addresses before activation. No activation block was fixed in the published proposal.
ALSO READ: Bitcoin Price Tests USD 75K Support Amid Wall Street, Asian Stock Rout