Binance Hackers Swap About $50 Million of Stolen XRP Mostly Into Bitcoin, Elliptic Says

Hackers tied to the record Binance theft have begun converting a large slice of the stolen XRP into bitcoin, blockchain analytics firm Elliptic said in an update dated through Friday, with about 42 million XRP — roughly $50 million — already swapped, mostly through THORChain.

Converted bitcoin from other stolen assets nearly doubled overnight to about 1,650 BTC, worth some $124 million, Elliptic wrote . Most of that jump came from the XRP route. About 192 million XRP, roughly $226 million, remained unswapped in addresses linked to the Binance theft.

The XRP was part of the Oct. 29 drain that Binance later put at $6.34 billion. Between 20:05 and 20:09 UTC that day, five hot wallets sent 233.46 million XRP to an attacker address. The FBI has attributed the campaign to North Korea’s TraderTraitor group. Binance has reopened withdrawals in stages and said it has frozen or intercepted about $2.85 billion while covering customer losses from its own funds.

The stolen XRP sat quiet at first. Early on Nov. 2, between 02:12 and 04:00 UTC, all about 233 million XRP moved into six new addresses, where it stayed until Nov. 5, Elliptic said . From the afternoon of Nov. 5, two of those six addresses began sending XRP on to dozens of new accounts that swapped it, mostly through THORChain into bitcoin.

A small amount of ether also went through THORChain into bitcoin that evening. The main bitcoin and ether holdings from the theft — the largest pools — have still not moved, Elliptic said. That pattern matches what the firm saw after the Bybit hack: turn freezable and mid-liquidity tokens into bitcoin first, then attempt cash-out later through OTC brokers.

The broader laundering trail is already vast. Since the Binance theft, Elliptic has counted more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions — roughly one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses linked to the Binance theft, mostly as ether and bitcoin. A negligible amount has likely been cashed out so far.

Issuers can freeze many stablecoins. They cannot freeze XRP the same way, and they cannot freeze bitcoin. After Tether and Circle locked down large stablecoin tranches on Oct. 29, the attacker prioritized assets that sit outside that kill switch. Swapping XRP into bitcoin continues that logic: bitcoin is harder to claw back once it is fragmented across fresh addresses.