$124M in Bitcoin: Binance Hackers Are Moving Fast While $2.85B Sits Frozen
The hackers behind the Binance breach quietly converted stolen tokens into $124 million in Bitcoin — and blockchain analytics firm Elliptic says almost none of it has been cashed out yet.
That's the detail that should have every crypto trader paying attention right now.
According to Elliptic's analysis, the attackers swapped the pilfered tokens for Bitcoin in what looks like a classic layering move: convert the traceable stuff into the most liquid, most portable asset in crypto, then wait. It's the same playbook used in nearly every major on-chain theft in recent memory, and it usually means the real exit is still coming.
The $2.85 Billion Overhang
Here's the number that actually matters: $2.85 billion in stolen crypto remains frozen. That's not recovered. That's not gone. It's sitting on-chain, locked by coordinated action from exchanges, validators, and law enforcement — but it isn't destroyed.
Frozen funds have a history of moving the moment attention shifts. The attackers are almost certainly watching network conditions, regulatory heat, and exchange liquidity windows. The $124M Bitcoin swap suggests they're not panicking — they're being patient and methodical.
Elliptic's read is that the broader cash-out hasn't started in any meaningful way. That's either reassuring or alarming depending on how you look at it. Reassuring because the damage isn't fully realized. Alarming because the worst pressure on markets may still be ahead if that $2.85B ever starts moving.
Binance Responds: Withdrawals Coming Back Online
Binance is moving to reopen withdrawals in stages, a signal that the exchange believes it has stabilized the situation enough to restore normal operations. That's a confidence play, and the market will be watching closely to see if the user response is calm re-engagement or a sprint for the exits.
Withdrawal reopenings after a major hack are a critical moment. Historically, they either mark the bottom of the panic or trigger a second wave of selling as nervous holders finally get the chance to leave.
What Traders Should Watch Right Now
Three things matter here going forward:
1. Bitcoin wallet activity tied to the known attacker addresses. Elliptic and other on-chain trackers are monitoring these. Any large movement will hit crypto Twitter before it hits the news. 2. Binance withdrawal volume in the next 48 to 72 hours. A surge could pressure BNB and broader altcoin liquidity. 3. The $2.85B freeze holding. If even a fraction of that begins moving through mixers or cross-chain bridges, expect immediate market reaction.
The hack isn't over. The exit is just getting started.