Binance Hackers Swap About $50 Million of Stolen XRP Mostly Into Bitcoin, Elliptic Says

The conversion represents a significant shift in the hackers' strategy since the Oct. 29 theft that Binance later valued at $6.34 billion. Between 20:05 and 20:09 UTC on that day, five hot wallets transferred 233.46 million XRP to an attacker address. The FBI has attributed this campaign to North Korea's TraderTraitor group.

The stolen XRP remained dormant until early Nov. 2, when all 233 million XRP moved into six new addresses. From the afternoon of Nov. 5, two of those addresses began sending XRP to dozens of new accounts that swapped it, primarily through THORChain into bitcoin.

Conversion Strategy

The conversion follows a pattern observed after other major crypto hacks. The hackers prioritize converting freezable and mid-liquidity tokens into bitcoin first, then attempt cash-out later through over-the-counter brokers. This approach minimizes the risk of having assets frozen while increasing the difficulty of tracing the funds.

About 1,650 BTC, worth approximately $124 million, now exists from the stolen assets, with nearly half of that increase coming from the XRP conversion. The main bitcoin and ether holdings from the theft—the largest pools—have still not moved, suggesting the hackers are proceeding methodically.

Laundering Scale

The broader laundering operation is already vast, with Elliptic counting more than 20,000 wallets across 16 blockchains, at least 36 services, and approximately 65,000 transactions—roughly one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses linked to the Binance theft.

Some converted bitcoin has entered Wasabi-style coinjoins—about 33 BTC, or $2.5 million, since Nov. 1—and about $1.1 million in ether and SOL entered the Privacy Cash pool before that service paused deposits. Elliptic noted the speed of these transactions suggests conventional automation rather than AI-driven decisions.

Next Steps

U.S. bank supervisors have already contacted lenders following the Binance breach. The critical question now is how much more of the remaining 192 million XRP—and eventually the parked ether—gets converted to BTC before any cash-out attempts. The test lies with whether THORChain operators and other bridges can continue blocking the published attacker addresses fast enough to slow the conversion process.

Binance has reopened withdrawals in stages and reported freezing or intercepting about $2.85 billion while covering customer losses from its own funds. The remaining stolen assets represent a substantial sum that could impact crypto markets if successfully converted and cashed out.