Elliptic now traces approximately 2,300 BTC worth $175 million in Bitcoin addresses receiving proceeds converted from other assets stolen in the October 29 Binance hack. The investigation, updated November 7, 2026, at 08:00 UTC, shows the amount rising from about 1,650 BTC a day earlier as more XRP was swapped mainly through THORChain. The figure is separate from roughly 18,270 BTC stolen directly during the attack, which Elliptic says has not moved.

The analyst’s newest on-chain report follows a theft it values at $6.43 billion. The FBI attributed the intrusion to North Korea’s TraderTraitor operators on October 31. BitcoinVersus.Tech previously covered the employee targeting and malicious development tools and Binance leadership’s description of the multi-stage attack. The new evidence concerns the aftermath, not a second theft.

XRP swaps accelerate into Bitcoin

Elliptic reports another 44 million XRP, about $51 million, leaving attacker-linked addresses overnight. Most was routed through THORChain into Bitcoin. Approximately 148 million XRP, then valued near $173 million, remained in addresses linked to the theft. Stolen Solana assets, previously valued near $90 million, had also been swapped, bridged or mixed. Some transactions crossed four blockchains within hours.

A cross-chain swap exchanges value across distinct networks; it is not an ordinary bank withdrawal. Bridges, decentralized exchanges and intermediary wallets can fragment the transaction trail. Elliptic says the operation has involved more than 20,000 wallets, 16 blockchains, at least 36 services and 65,000 transactions. Its attribution counts may change as investigators identify additional wallets and routes.

Conversion does not equal cashing out

Elliptic estimates that $2.85 billion of the original theft is frozen and about $3.13 billion remains in attacker-linked addresses. Only a negligible amount has likely been cashed out, according to the firm. Converting XRP or SOL into BTC moves value between assets; recovering spendable proceeds through a broker, exchange or another counterparty is a distinct stage with additional opportunities for detection and intervention.

The findings also challenge suggestions that AI agents independently controlled the laundering. Transfers show highly automated timing, recurring amounts and scripted retries, but Elliptic says it has not seen evidence of AI-directed decisions. BitcoinVersus.Tech previously reported early speculation about agentic laundering; the latest data supports automation without demonstrating agent autonomy.

Multi-chain tracing tests compliance systems

Elliptic describes Bitcoin coinjoins and the Privacy Cash pool as methods that can weaken visible links between deposits and withdrawals. Privacy tools also have legitimate users, and involvement in a shared transaction does not automatically implicate unrelated participants in a theft. Investigators must assess provenance, timing, service records and other evidence.

The FBI urged exchanges, bridge operators and other digital-asset service providers to screen for published TraderTraitor wallet addresses. BitcoinVersus.Tech also covered FinCEN’s separate action concerning alleged illicit crypto flows, illustrating the wider need for independently verified transaction intelligence.

The immediate development is measurable growth in traced Bitcoin conversions, not proof that stolen funds have been recovered or successfully cashed out. Future investigations may revise linked-wallet counts and balances. Maintaining accurate screening without wrongly implicating unrelated users remains a core technical and operational challenge.

Editor’s Note: The 2,300 BTC, $175 million, XRP, frozen-balance and wallet-activity figures were checked against Elliptic’s investigation updated November 7, 2026, at 08:00 UTC. Responsibility attribution was checked against the FBI’s October 31 TraderTraitor advisory. The 2,300 BTC represents conversions from other stolen cryptoassets and excludes directly stolen Bitcoin; conversion does not establish cashing out. Wallet and valuation estimates can change. The cover is an editorial illustration; in-body diagrams were produced by Elliptic. The Coin Bureau video dates to December 2021 and is educational background. Public playback and independent desktop/mobile layout checks remain unverified.

To donate 5,000 sats, open the article on a separate display and scan the original QR code with a compatible Bitcoin wallet. On mobile, use another screen or your wallet’s supported image-scanning feature. Verify the destination 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb before sending.

We volunteer daily to ensure the information on this platform is Verifiably True. If you would like to support the research, please scan QR code.

BitcoinVersus.tech is not a financial advisor. Cryptocurrency and financial-crime reporting is provided for informational purposes.