Hackers tied to the record Binance theft have begun converting a large slice of the stolen XRP into bitcoin, blockchain analytics firm Elliptic said in an update dated through Friday, with about 42 million XRP — roughly $50 million — already swapped, mostly through THORChain.
Converted bitcoin from other stolen assets nearly doubled overnight to about 1,650 BTC, worth some $124 million, Elliptic wrote. Most of that jump came from the XRP route. About 192 million XRP, roughly $226 million, remained unswapped in addresses linked to the Binance theft.
The XRP was part of the Oct. 29 drain that Binance later put at $6.34 billion. Between 20:05 and 20:09 UTC that day, five hot wallets sent 233.46 million XRP to an attacker address. The FBI has attributed the campaign to North Korea’s TraderTraitor group. Binance has reopened withdrawals in stages and said it has frozen or intercepted about $2.85 billion while covering customer losses from its own funds.
How the XRP started moving
The stolen XRP sat quiet at first. Early on Nov. 2, between 02:12 and 04:00 UTC, all about 233 million XRP moved into six new addresses, where it stayed until Nov. 5, Elliptic said. From the afternoon of Nov. 5, two of those six addresses began sending XRP on to dozens of new accounts that swapped it, mostly through THORChain into bitcoin.
A small amount of ether also went through THORChain into bitcoin that evening. The main bitcoin and ether holdings from the theft — the largest pools — have still not moved, Elliptic said. That pattern matches what the firm saw after the Bybit hack: turn freezable and mid-liquidity tokens into bitcoin first, then attempt cash-out later through OTC brokers.
The broader laundering trail is already vast. Since the Binance theft, Elliptic has counted more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions — roughly one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses linked to the Binance theft, mostly as ether and bitcoin. A negligible amount has likely been cashed out so far.
Why XRP and bitcoin matter here
Issuers can freeze many stablecoins. They cannot freeze XRP the same way, and they cannot freeze bitcoin. After Tether and Circle locked down large stablecoin tranches on Oct. 29, the attacker prioritized assets that sit outside that kill switch. Swapping XRP into bitcoin continues that logic: bitcoin is harder to claw back once it is fragmented across fresh addresses.
All of the stolen SOL, about $87 million at Elliptic’s prices, has already been swapped, bridged or mixed, with much of it ending as bitcoin. Most early Tron laundering — about $220 million in TRX — has also run, a flow Bitcoin Magazine noted when covering the quiet shutdown of the T3 Financial Crime Unit before the hack. Only small parts of the main ether and NEAR piles have moved.
Some converted bitcoin has gone into Wasabi-style coinjoins — about 33 BTC, or $2.5 million, since Nov. 1 — and about $1.1 million in ether and SOL entered the Privacy Cash pool before that service paused deposits. Elliptic said the speed points to conventional automation, not an AI agent making live decisions: fixed timing, set amounts, blind retries and new tactics introduced hours apart.
U.S. bank supervisors have already checked in with lenders after the Binance breach. For bitcoin markets, the nearer question is how much more of the remaining ~192 million XRP — and eventually the parked ether — gets turned into BTC before anyone tries to cash out.
The test now is whether THORChain operators and other bridges keep blocking the published attacker addresses fast enough to slow the XRP-to-bitcoin pipe, or whether the rest of that pile follows the same overnight path the first $50 million already took.