Stolen Binance Bitcoin, XRP on the Move as $3.1B Remains Unlaundered: Elliptic - Bitcoin News
Hackers behind the $6.4 billion Binance theft have begun moving stolen XRP and converting more cryptocurrency into bitcoin, although approximately $3.1 billion in assets remains largely untouched more than a week after the attack, according to the latest findings from blockchain analytics firm Elliptic.
The investigation into the October 29 breach has entered a new phase, with the attackers actively attempting to obscure the trail of the stolen funds. The hackers have moved approximately 42 million XRP, worth $50 million, since Thursday afternoon, swapping much of it into bitcoin through the cross-chain exchange protocol THORChain.
This activity has pushed the total value of stolen cryptocurrency converted into bitcoin to approximately 1,650 BTC, valued at $124 million as of Friday morning. The total nearly doubled over the preceding day, with XRP accounting for the majority of the increase.
The findings mark a new phase in the hackers’ efforts to conceal the stolen assets.
Despite this accelerating activity, Elliptic estimated that $3.11 billion remains in addresses associated with the theft, primarily in bitcoin and ether. The original 18,270 BTC stolen from Binance has not moved since being distributed across 19 wallets shortly after the attack.
The largest ether holdings also remain untouched. Elliptic estimated that only about $3 million of the roughly $1.33 billion in stolen ETH had been moved through laundering channels, while the nine largest ETH wallets have remained inactive since Oct. 30.
Laundering Techniques
The hackers have employed a sophisticated array of tools to obfuscate the origin of the funds. Solana assets have been a particular focus, with essentially all of the stolen SOL, worth approximately $87 million, now swapped, transferred between blockchains, or mixed through privacy services.
The researchers identified approximately $2.5 million in bitcoin processed through Wasabi-style coinjoin transactions, which combine coins from multiple users to complicate blockchain tracking. Another $1.1 million in stolen ETH and SOL entered the Privacy Cash protocol beginning Nov. 3, prompting the service to temporarily suspend deposits.
The laundering network has expanded dramatically since the breach. Elliptic has now identified more than 20,000 wallets across 16 blockchains, involving at least 36 services and 65,000 transactions.
FBI Attribution and Binance Response
The FBI has attributed the attack to North Korea’s TraderTraitor hacking operation, although Pyongyang has denied responsibility. Binance disclosed Tuesday that the breach followed a months-long campaign involving malicious developer software, fraudulent job interviews, and compromised internal artificial intelligence tools.
The attackers ultimately gained access to wallet-signing infrastructure and executed unauthorized transactions across numerous blockchains. Of the original $6.43 billion stolen, approximately $2.85 billion has been frozen or seized, largely through intervention by stablecoin issuers.
Elliptic expects the remaining ether holdings to be gradually converted into bitcoin, followed by attempts to exchange the cryptocurrency for conventional money through over-the-counter brokers and trading platforms. The firm drew comparisons to the February 2025 Bybit hack—the previous record high crypto heist with about $1.5 billion swiped—when North Korean attackers converted approximately 499,000 stolen ETH within 10 days.
Related
