Binance Hackers Swap About $50 Million of Stolen XRP Mostly Into Bitcoin, Elliptic Says
Blockchain analytics firm Elliptic reported in an update through Friday that perpetrators linked to the historic Binance breach have started converting a major portion of the stolen XRP into bitcoin, with approximately 42 million XRP—valued at roughly $50 million—already exchanged, primarily via THORChain.
According to Elliptic, converted bitcoin derived from other pilfered assets nearly doubled overnight, reaching approximately 1,650 BTC, which amounts to about $124 million. The majority of this increase originated from the XRP conversion path. Meanwhile, roughly 192 million XRP, representing about $226 million, remains unswapped within addresses connected to the Binance attack.
This XRP originated from the October 29 drain, an incident Binance later estimated at $6.34 billion. On that day, between 20:05 and 20:09 UTC, five hot wallets transferred 233.46 million XRP to an attacker address. The FBI has ascribed the operation to North Korea’s TraderTraitor collective. Binance has since resumed withdrawals incrementally and reported that it has frozen or intercepted approximately $2.85 billion while absorbing customer losses using its own reserves.
How the XRP started moving
Initially, the stolen XRP remained dormant. Elliptic noted that between 02:12 and 04:00 UTC on November 2, the entire pool of roughly 233 million XRP was shifted into six newly created addresses, where it rested until November 5. Beginning on the afternoon of November 5, a pair of those six addresses began routing XRP to dozens of fresh accounts to facilitate the swaps into bitcoin, largely through THORChain.
That same evening, a minor quantity of ether was also funneled through THORChain into bitcoin. Elliptic pointed out that the primary bitcoin and ether holdings from the breach—representing the largest pools—have not yet been moved. This behavior mirrors the patterns observed by the firm following the Bybit hack: convert mid-liquidity and freeze-resistant tokens into bitcoin first, then attempt eventual cash-outs through over-the-counter (OTC) brokers.
The broader money-laundering footprint is already immense. Elliptic has tracked more than 20,000 wallets spread across 16 blockchains, along with a minimum of 36 services and 65,000 transactions since the Binance incident. This equates to roughly one new wallet generated every 30 seconds and a new transaction every 10 seconds. Approximately $3.11 billion stays parked in addresses tied to the Binance theft, primarily held as ether and bitcoin, with only a negligible fraction having been successfully cashed out so far.
Why XRP and bitcoin matter here
While issuers possess the capability to freeze numerous stablecoins, they cannot freeze XRP in the same manner, nor can they freeze bitcoin. Following the quick freezing of substantial stablecoin tranches by Tether and Circle on October 29, the perpetrator prioritized assets existing outside those emergency mechanisms. Exchanging XRP for bitcoin aligns with this strategy, as bitcoin becomes considerably more difficult to reclaim once fragmented across newly generated addresses.
All stolen Solana (SOL)—valued at roughly $87 million based on Elliptic’s pricing—has already been swapped, bridged, or mixed, with a significant share converting into bitcoin. Similarly, the bulk of early Tron laundering, encompassing about $220 million in TRX, has processed, a flow previously highlighted by Bitcoin Magazine during its coverage of the quiet shutdown of the T3 Financial Crime Unit right before the hack. Only fractional amounts of the main ether and NEAR stashes have shifted.
Portions of the converted bitcoin—about 33 BTC, or $2.5 million, since November 1—have been funneled into Wasabi-style coinjoins, while roughly $1.1 million in ether and SOL was routed into the Privacy Cash pool prior to that service halting deposits. Elliptic stated that the operational speed points to conventional automation rather than a live-decision AI agent, citing fixed timing, predetermined amounts, blind retries, and fresh tactics deployed hours apart.
U.S. banking regulators have already reached out to lenders in the wake of the Binance breach. For bitcoin markets, the more immediate question centers on how much of the remaining 192 million XRP, and eventually the parked ether, will be converted into BTC prior to any cash-out attempts.
The critical test moving forward is whether THORChain operators and other cross-chain bridges can continue blacklisting the identified attacker addresses rapidly enough to impede the XRP-to-bitcoin pipeline, or if the remainder of the pool will replicate the overnight trajectory taken by the initial $50 million.
FAQ
How much stolen XRP has been converted into bitcoin?
About 42 million XRP, worth roughly $50 million, has been swapped into bitcoin, mostly via THORChain.
Who is blamed for the Binance theft?
The FBI has attributed the hacking campaign to North Korea’s TraderTraitor group.
Why are the hackers converting XRP and other assets into bitcoin?
Unlike many stablecoins, issuers cannot freeze XRP or bitcoin, making bitcoin harder to claw back once fragmented across fresh addresses.
How much stolen funds remain in attacker-linked addresses?
Approximately $3.11 billion remains in addresses linked to the Binance theft, mostly held as ether and bitcoin.
