About $124 million of the cryptocurrency stolen in the record Binance hack has now been converted into Bitcoin, blockchain investigators said in an update this week, as the United States called for coordinated international action against the North Korean cyber operations blamed for the theft.
Blockchain intelligence firm Elliptic said in a November 6 update to its technical analysis that the value of stolen assets swapped into Bitcoin had reached approximately $124 million. The converted funds include holdings originally in other cryptocurrencies: roughly $50 million worth of XRP had begun moving largely towards Bitcoin, while stolen Solana tokens had also been swapped, bridged or mixed, according to the firm's tracing.
By Elliptic's November 6 checkpoint, analysts had identified about 1,650 Bitcoin held in new addresses following conversion from other stolen assets. The investigation describes activity involving tens of thousands of wallets, multiple networks and an assortment of services, with funds repeatedly crossing from one blockchain to another — a pattern that makes the trail harder to follow, because the deposit and payout sides of a transfer can occur on different networks and pass through pools, aggregators and intermediaries.
Elliptic cautioned that its figures are a dated snapshot of a fast-moving investigation and should not be treated as permanent totals. The firm reported that approximately $2.85 billion of the original stolen assets had been frozen and about $3.11 billion remained in addresses linked to the theft at its latest checkpoint, with only a negligible portion appearing to have been cashed out. Converting stolen cryptocurrency into Bitcoin is not the same as spending it through the conventional financial system, and the public nature of blockchain transactions still lets investigators reconstruct substantial parts of the flow.
The theft itself took place on October 29, when more than $6 billion in digital assets was taken from Binance, the world's largest cryptocurrency exchange, in what investigators have described as the largest cryptocurrency theft on record. Binance said in its November 3 incident report that the intrusion began with a fabricated job interview designed to gain the trust of employees, that an engineer's laptop was compromised, and that the attackers exploited an Ethereum mechanism known as EIP-7702, which lets ordinary accounts temporarily delegate transaction-signing authority to smart contracts.
The US Federal Bureau of Investigation said in an advisory on October 31 that North Korea's state-backed hacking unit TraderTraitor, also known as the Lazarus Group, orchestrated the theft, and it called on industry partners to help block transactions involving cryptocurrency accounts linked to the group. The same unit was blamed for a then-record $1.5 billion hack of the Bybit exchange in 2025, and North Korea has repeatedly been accused of relying on cybercrime to help finance its sanctioned economy and weapons programmes.
Pyongyang has denied the accusation. Kim Yo Jong, a senior North Korean official and the sister of leader Kim Jong Un, said on Tuesday that the claims were another attempt to blame North Korea, according to the BBC. The denial has not changed the assessment of American investigators, and the US State Department moved on Saturday to widen the response beyond attribution.
"Particularly in light of the recent hack of Binance, it is critical for governments to work together and do their own part to mitigate the DPRK cyber threat and curb illicit DPRK revenue generation," a State Department spokesperson told South Korea's Yonhap news agency in a written response on Saturday. The spokesperson added that the United States expects all United Nations member states to enforce existing sanctions and take proactive measures to prevent Pyongyang from funding its unlawful weapons of mass destruction and ballistic missile programmes, and that coordinated unilateral sanctions remain a strong tool to prevent money flowing to weapons proliferation.
South Korea, whose exchanges and citizens sit close to the fallout, has not yet settled its own response. A South Korean unification ministry official said on Thursday that Seoul had not yet begun discussing sanctions over the incident because the circumstances had not been fully established, while the foreign ministry said separately that it was internally reviewing possible additional measures, including unilateral cyber sanctions, but that no decision had been made. The American remarks came in response to a question about coordination between Washington and Seoul on additional sanctions after the FBI's attribution.
The hack has already shaken confidence in the exchange and the wider market. Customers withdrew $4.72 billion from Binance in the immediate aftermath, and Bitcoin fell below $75,000 in the days after the breach, its first time under that level since August. Binance has said it would cover all of the losses linked to the attack and that it had so far covered around 95 percent of the assets stolen, and trading in major cryptocurrencies on the exchange has since resumed after the company worked with issuers to freeze affected assets.
What happens next is likely to be decided in two places at once: on the blockchain, where investigators are watching whether the converted Bitcoin moves towards identifiable services or brokers that would allow a cash-out, and in government, where Washington is pressing allies to act together and Seoul is weighing its own sanctions. Elliptic's data show the stolen funds are still moving through complex paths, and the next meaningful updates will concern verified freezes, attributed movements and evidence of actual cash-outs — the points at which a theft measured in billions either becomes recoverable money or disappears into the system it was stolen from.
Figures in this report were checked at 10:55 PKT on 08 November 2026 against reports from NewsBTC/TradingView, Yonhap News Agency, Korea JoongAng Daily and the BBC.
This post is market news information only, not financial advice.
