Elliptic: Hackers Convert $50M of Stolen Binance XRP to Bitcoin

According to blockchain analytics firm Elliptic, hackers linked to the massive Binance theft have started converting a significant portion of the stolen XRP into bitcoin. In an update through Friday, Elliptic reported that roughly 42 million XRP — valued at approximately $50 million — has already been swapped, primarily via THORChain.

Elliptic noted that converted bitcoin from other stolen assets nearly doubled overnight, reaching roughly 1,650 BTC, valued at around $124 million, with the XRP route accounting for most of the increase. Approximately 192 million XRP, worth some $226 million, remained unswapped in addresses associated with the Binance theft.

The XRP was part of the Oct. 29 drain that Binance later estimated at $6.34 billion. Between 20:05 and 20:09 UTC that day, 233.46 million XRP was transferred from five hot wallets to an attacker address. The FBI has linked the campaign to North Korea's TraderTraitor group. Binance has gradually reopened withdrawals, stating it has frozen or intercepted about $2.85 billion while covering customer losses from its own funds.

How the XRP started moving

The stolen XRP initially remained inactive. Elliptic said that between 02:12 and 04:00 UTC on Nov. 2, all roughly 233 million XRP was moved into six new addresses, where it remained until Nov. 5. Starting from the afternoon of Nov. 5, two of those six addresses began sending XRP to dozens of new accounts that swapped it, mostly through THORChain into bitcoin.

A small amount of ether was also swapped into bitcoin via THORChain that evening. Elliptic said the main bitcoin and ether holdings from the theft — the largest pools — have still not moved. That pattern matches what the firm observed after the Bybit hack: converting freezable and mid-liquidity tokens into bitcoin first, then attempting cash-out later through OTC brokers.

The broader laundering trail is already extensive. Since the Binance theft, Elliptic has identified over 20,000 wallets across 16 blockchains, at least 36 services, and at least 65,000 transactions — roughly one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses linked to the Binance theft, predominantly as ether and bitcoin. A negligible amount has likely been cashed out so far.

Why XRP and bitcoin matter here

Many stablecoins can be frozen by issuers, but XRP cannot be frozen in the same way, nor can bitcoin. After Tether and Circle froze large stablecoin tranches on Oct. 29, the attacker prioritized assets outside that kill switch. Swapping XRP into bitcoin continues that logic, as bitcoin is harder to recover once fragmented across fresh addresses.

All of the stolen SOL, about $87 million at Elliptic's prices, has already been swapped, bridged, or mixed, with much of it ending as bitcoin. Most early Tron laundering — approximately $220 million in TRX — has also been processed, a flow previously noted when covering the quiet shutdown of the T3 Financial Crime Unit before the hack. Only small portions of the main ether and NEAR piles have moved.

Some converted bitcoin has entered Wasabi-style coinjoins — roughly 33 BTC, or $2.5 million, since Nov. 1 — and about $1.1 million in ether and SOL entered the Privacy Cash pool before that service paused deposits. Elliptic said the speed suggests conventional automation rather than an AI agent making live decisions: fixed timing, set amounts, blind retries, and new tactics introduced hours apart.

U.S. bank supervisors have already reached out to lenders following the Binance breach. For bitcoin markets, the nearer question is how much more of the remaining roughly 192 million XRP — and eventually the parked ether — gets turned into BTC before anyone attempts a cash-out.

The test now is whether THORChain operators and other bridges can block the published attacker addresses quickly enough to slow the XRP-to-bitcoin pipeline, or whether the rest of that pile follows the same overnight path the first $50 million already took.