Hackers behind the Oct. 29, 2026, Binance breach converted approximately $175 million in stolen altcoins into about 2,300 BTC, according to blockchain analytics firm Elliptic. The conversion involved assets already taken in the incident rather than newly stolen funds. Chainalysis previously said the funds were initially divided among more than 10,000 wallets, while Elliptic’s Nov. 7 account tracked more than 20,000 wallets across 16 blockchains, at least 36 services and 65,000 transactions. The transfers averaged roughly one new wallet every 30 seconds and one transaction every 10 seconds, reflecting extensive automation but not establishing that artificial intelligence directed the activity. SOL, XRP and TRX contributed to the bitcoin conversions, with about $90 million in SOL moving through swaps, bridges and privacy services. THORChain facilitated cross-network conversions, while Ethereum represented a smaller portion of the assets exchanged. Elliptic also tracked about 88 BTC, valued at $6.7 million, entering Wasabi-style coinjoins, and approximately 412,000 NEAR worth $1.5 million leaving the main account in small batches. The primary bitcoin and ether holdings remained dormant, and Elliptic said only a negligible amount had likely reached the cash-out stage. Arkham’s labeled entity showed 18,384.725 BTC at 10 a.m. Eastern on Nov. 7, compared with 18,270.2 BTC drained during the breach; its page later displayed approximately 18,387 BTC. That increase was far below Elliptic’s 2,300 BTC conversion estimate, with the discrepancy unresolved because the platforms may use different address groupings, timestamps and coverage. Binance said the incident involved unauthorized access to an internal wallet signing service after employee devices were compromised by malicious software. The exchange said it closed the entry points, rebuilt or replaced affected systems, replenished 98% of impacted token assets by Oct. 31 and continued buying remaining illiquid assets. Binance put the affected assets at approximately $6.34 billion in a Nov. 3 report, said it had reserved sufficient funds to absorb the impact, and reported about $2.85 billion in frozen or intercepted assets. It also cited FBI information attributing the incident to North Korea.