Binance Hackers Convert $50 Million of Stolen XRP Into Bitcoin

Attackers tied to the record Binance theft have swapped roughly 42 million XRP — about $50 million — into bitcoin, blockchain analytics firm Elliptic said in an update dated through Friday. Most of that conversion ran through THORChain, the cross-chain protocol that has become the primary pipe for moving the stolen funds out of freezable assets.

Converted bitcoin from all stolen assets nearly doubled overnight to about 1,650 BTC, worth roughly $124 million, Elliptic wrote. The XRP route drove most of that jump. About 192 million XRP, worth some $226 million, remained unswapped in addresses linked to the Binance theft.

The XRP came from the Oct. 29 drain that Binance later sized at $6.34 billion. Between 20:05 and 20:09 UTC that day, five Binance hot wallets sent 233.46 million XRP to a single attacker address. The FBI has attributed the campaign to North Korea's TraderTraitor group. Binance has reopened withdrawals in stages and said it froze or intercepted about $2.85 billion while covering customer losses from its own funds.

How did the XRP start moving?

The stolen XRP sat idle for days. Early on Nov. 2, between 02:12 and 04:00 UTC, all 233 million XRP moved into six new addresses, where it stayed until Nov. 5, according to Elliptic. From the afternoon of Nov. 5, two of those six addresses began forwarding XRP to dozens of fresh accounts that swapped it — mostly through THORChain — into bitcoin.

A small amount of ether also crossed THORChain into bitcoin that evening. The main bitcoin and ether pools from the theft have still not moved, Elliptic said. The firm said the pattern matches what it observed after the Bybit hack: convert freezable and mid-liquidity tokens into bitcoin first, then attempt cash-out later through over-the-counter brokers.

The broader laundering trail is already vast. Since the theft, Elliptic has counted more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions — roughly one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses linked to the theft, mostly as ether and bitcoin. Elliptic assessed that only a negligible amount has likely been cashed out so far.

Why swap XRP into bitcoin?

Issuers can freeze many stablecoins; they cannot freeze XRP the same way, and they cannot freeze bitcoin at all. After Tether and Circle locked down large stablecoin tranches on Oct. 29, the attacker prioritized assets that sit outside that kill switch. Bitcoin is harder to claw back once fragmented across fresh addresses, so the XRP-to-BTC conversion extends that logic.

The pattern extends across other chains:

• All of the stolen SOL — about $87 million at Elliptic's prices — has already been swapped, bridged or mixed, with much of it ending as bitcoin.
• Most early Tron laundering, about $220 million in TRX, has also run.
• Only small parts of the main ether and NEAR piles have moved.
• About 33 BTC ($2.5 million) of converted bitcoin has entered Wasabi-style coinjoins since Nov. 1.
• About $1.1 million in ether and SOL entered the Privacy Cash pool before that service paused deposits.

Elliptic said the operational speed points to conventional automation rather than an AI agent making live decisions: fixed timing, set amounts, blind retries and new tactics introduced hours apart. The Federal Reserve and OCC have already contacted U.S. lenders following the breach, adding a supervisory dimension to the fallout.

The immediate question for market structure is throughput: how much of the remaining 192 million XRP — and eventually the parked ether — converts to BTC before anyone attempts cash-out. The test now is whether THORChain operators and other bridges block published attacker addresses fast enough to slow the pipe, or whether the rest of the pile follows the same overnight path the first $50 million already took.