Wallets Linked to Binance Hack Move $51 Million in XRP Into Bitcoin

Wallets tied to the Binance theft moved approximately 44 million XRP, worth about $51 million, out of addresses holding the stolen tokens overnight through Nov. 7, according to on-chain records. Most of that XRP was converted into Bitcoin (BTC) through THORChain, the cross-chain liquidity protocol the attacker has used repeatedly during the past week of laundering activity.

The numbers frame the scale of the operation. By 3 a.m. ET on Nov. 7 (08:00 UTC), roughly 2,300 BTC — valued at $175 million — had reached new Bitcoin addresses after conversion from other stolen assets. That figure tracks converted funds separately from the attacker's original holdings. Meanwhile, approximately 148 million XRP, valued at $173 million, still sat in theft-linked addresses awaiting movement. The attacker's main Bitcoin and Ether (ETH) troves remained unmoved.

For context, the $175 million in converted Bitcoin already exceeds the total losses of most major exchange hacks recorded in the past five years. The remaining $173 million in XRP alone represents a second tranche of comparable size still queued for conversion.

Where is the money going?

The routing pattern is consistent and deliberate. Stolen XRP moves to THORChain, where it is swapped into Bitcoin without passing through a centralized custodian. The resulting BTC lands at fresh addresses under the attacker's control. THORChain has become the dominant rail for this rotation because it settles cross-chain swaps without identity checks — the same property that makes it useful for legitimate users seeking self-custody.

Mixing activity intensified in parallel. Approximately 53 BTC, worth $4 million, entered Wasabi-style CoinJoin transactions overnight. That brings the total pushed through CoinJoin mixing to roughly 88 BTC, or $6.7 million — a small fraction of the converted pool, but a clear signal that the attacker is layering obfuscation on top of the conversion pipeline.

What does this change for practitioners?

Three operational consequences follow directly from the on-chain record.

• Compliance teams now face a growing set of Bitcoin addresses pre-funded with THORChain-origin BTC. Screening inbound deposits against the published theft-linked cluster remains the primary control, and the cluster expands daily.
• Exchanges and OTC desks handling XRP or BTC should treat conversions arriving from THORChain routing paths with elevated scrutiny through the laundering window.
• Investigators can still trace CoinJoin outputs probabilistically; the $6.7 million mixed so far is small relative to the $175 million converted, leaving most proceeds visibly traceable for now.

The attacker's decision to leave the core Bitcoin and Ether holdings untouched, while rotating XRP and other assets, suggests a staged liquidation rather than a rapid exit. Each tranche converted through THORChain adds new addresses to the linked cluster, which blockchain-analytics firms continue to tag in near real time.

What comes next

The critical variable is the pace of the remaining XRP. If the attacker sustains the overnight rate observed through Nov. 7, the $173 million still held in theft-linked addresses could rotate into Bitcoin within days, expanding the tainted-BTC cluster well beyond its current footprint before exchange risk and freezing actions catch up.