Hackers Convert $50M in Stolen XRP to 1,650 BTC via THORChain

Hackers have swapped approximately $50 million worth of stolen XRP for 1,650 BTC, according to blockchain analytics firm Elliptic, with the bulk of the conversion routed through THORChain, the cross-chain liquidity protocol.

The swapped funds form part of a larger theft of 233 million XRP from Binance, an incident the FBI has linked to North Korean state hackers. Elliptic's report indicates that the main holdings of stolen Ethereum and Bitcoin from the same operation remain untouched, meaning the XRP conversion represents the most active laundering channel to date in the case.

Why THORChain matters here

The choice of venue is the operative detail. XRP is issued under a ledger design that historically allows issuers to freeze balances at the account level, a control that has been exercised in past hacks. Bitcoin carries no such freeze function. By routing the stolen XRP through THORChain, the attackers convert an issuer-freezable asset into one that cannot be recalled by any central party.

For compliance teams, that routing pattern matters. THORChain has appeared repeatedly in laundering flows following major exploits, and Elliptic's attribution work here demonstrates that cross-chain swaps are traceable but not reversible. Practitioners should expect analytics firms to treat THORChain conversion events as high-risk indicators when screening deposit flows on the Bitcoin side.

What does this change for exchanges and issuers?

The conversion narrows the intervention window. Once stolen XRP leaves its native ledger for Bitcoin, freeze mechanisms on the originating chain no longer bind the funds. The remaining untouched Ethereum and Bitcoin holdings suggest the attackers are staging, rather than rushing, their exit — a pattern that typically precedes sustained conversion activity rather than a single liquidation event.

That staging behavior gives exchanges and investigators a live monitoring problem. Detection now depends on tracing 1,650 BTC as it fragments across wallets and services, not on freezing a static XRP balance.

Market and regulatory signals

Elliptic's findings have already registered in sentiment-sensitive venues. Prediction markets tied to XRP's price have shown significant movement, and the report notes that the conversion activity may weigh on near-term sentiment around the token.

The more durable question is institutional. The FBI's attribution to North Korean state actors places the incident within an established enforcement framework — the Treasury Department has previously sanctioned wallets and mixer services connected to similar laundering pipelines. A regulatory response from Binance, or targeted designations against the receiving addresses, remains a plausible next step.

What to watch

The volume of further conversions is the leading indicator. If the untouched Ethereum and Bitcoin holdings begin moving through comparable cross-chain routes, it would signal a coordinated liquidation phase and intensify screening pressure on decentralized exchange liquidity pools. Absent that movement, the immediate exposure stays concentrated in the 1,650 BTC already converted.

Observers should also monitor any statement from Binance and any follow-on action from U.S. authorities, both of which would define how quickly the receiving addresses become toxic across the compliance ecosystem.