Elliptic traced about $175 million in assets stolen from Binance into roughly 2,300 BTC, a shift that places the funds beyond the freezing power of token issuers.
At 3 a.m. ET (08:00 UTC) Nov. 7, the blockchain analytics firm said the stolen Bitcoin and the attacker's main Ether holdings had not moved. Its account also recorded transfers of a small portion of the Ether.
Elliptic counted at least 65,000 transactions through more than 20,000 wallets on 16 blockchains as the stolen funds moved after the theft. The original breach affected 11 blockchains, as EconoTimes reported in earlier coverage of Elliptic's assessment.
The firm identified about 88 BTC entering Wasabi-style coinjoin transactions by Nov. 7. That was a small fraction of the roughly 2,300 BTC obtained through the swaps.
Bitcoin.com News, reviewing Arkham Intelligence data, reported a later reading of 18,384.725 BTC in addresses labeled as connected to the attacker at 10 a.m. ET (15:00 UTC) Nov. 7. The outlet said the total did not show an addition of the newly swapped BTC. Elliptic's snapshot had been taken seven hours earlier.
Elliptic has estimated the total theft at $6.43 billion. Its Nov. 2 assessment put frozen or seized assets at $2.85 billion, largely in stablecoins. Elliptic identified issuers' ability to freeze some tokens as an incentive to move into Bitcoin or Ether, which have no central issuer able to freeze balances. Binance has said it would bear the financial impact rather than pass it to users.
For comparison, Elliptic said the operators behind the 2025 Bybit theft laundered all 499,000 stolen ETH in 10 days, mainly through Bitcoin swaps. Turning those proceeds into cash took months.
Elliptic assessed that little of the Binance-linked assets had been turned into spendable proceeds. It expects the remaining Ether to be swapped for Bitcoin before attempts to cash out through over-the-counter brokers or exchanges.
