Blockchain analytics firm Elliptic reported that hackers responsible for the massive Binance exploit have converted approximately 42 million XRP, valued around $50 million, primarily into bitcoin. The conversion reportedly took place mostly through THORChain, a decentralized cross-chain protocol. Elliptic’s findings highlight ongoing asset laundering efforts following the high-profile breach at Binance.
Details of the Binance theft and ongoing asset movements
The original incident occurred on October 29, when five hot wallets associated with Binance transferred a total of 233.46 million XRP to an attacker-controlled address. At the time, Binance estimated customer losses from the broader attack at $6.34 billion. The FBI identified North Korea’s TraderTraitor group as the perpetrators.
Following the hack, Binance gradually reopened withdrawals and stated that it had frozen or intercepted about $2.85 billion during the aftermath. The exchange also committed to covering all customer losses from its corporate resources.
Elliptic reported that, as of the latest update, bitcoin balances traced to the attack—which include assets from various swapped tokens—surged overnight to around 1,650 BTC, equivalent to about $124 million. This increase was driven largely by the recently converted XRP. Meanwhile, roughly 192 million XRP, worth an estimated $226 million, remains unswapped in wallets linked to the breach.
How the stolen funds were transferred and swapped
After remaining dormant for several days, the stolen XRP moved to six new addresses between 02:12 and 04:00 UTC on November 2. Elliptic observed that on November 5, two of these addresses began funneling XRP into dozens of new accounts, where it was primarily swapped for bitcoin via THORChain.
A small portion of ether followed a similar path, transitioning through THORChain into bitcoin. Neither the main pools of stolen bitcoin nor ether have moved as of the last Elliptic analysis, aligning with past behavior observed after the Bybit attack. In previous incidents, hackers have converted easily frozen tokens and moderate-liquidity assets into bitcoin ahead of attempting eventual cash-outs through over-the-counter trading channels.
Elliptic’s analysis noted the expansive scale of laundering activity: more than 20,000 wallets across 16 blockchains, at least 36 services, and over 65,000 transactions have been tied to the Binance incident. The data suggests that one new wallet emerges roughly every 30 seconds, with a related transaction executed every 10 seconds. Of the compromised funds, about $3.11 billion remains in addresses traced to the hack, predominantly held in ether and bitcoin, with only minor amounts believed to have been withdrawn for fiat currency.
The significance of asset selection and laundering strategy
Hackers reportedly shifted focus to XRP and bitcoin after issuers Tether and Circle locked affected stablecoin balances on October 29. While issuers can freeze USDT or USDC, XRP and bitcoin cannot be blocked by a central authority. The attacker’s move to prioritize XRP for conversion, and subsequently swapping it into bitcoin, reflects an effort to bypass freeze controls and further complicate asset recovery.
Elliptic indicated that all compromised SOL, valued at approximately $87 million, has already been swapped, bridged, or mixed—much of it also ending up as bitcoin. The majority of TRX linked to the incident, around $220 million, has been laundered. By contrast, most ether and NEAR from the hack remains unmoved.
Some of the converted bitcoin, about 33 BTC or $2.5 million, has entered Wasabi-style coinjoin mixers, while another $1.1 million in ether and SOL was sent to the Privacy Cash pool prior to that platform halting deposits. Elliptic described the pattern as driven by automation with set timing intervals, rather than dynamic live decision-making from artificial intelligence tools.
In light of these developments, CryptoAppsy’s real-time news monitoring and smart price alert features provide users with timely updates and notifications as major blocks of XRP are swapped and as BTC transaction volumes spike. These tools can help market participants track the progress of remaining stolen assets and any resulting impact on XRP and bitcoin markets.
Elliptic counted over 20,000 wallets across 16 blockchains and 65,000 transactions linked to the Binance breach, with new wallets and transactions occurring at a rapid pace as hackers continue asset laundering efforts.
US banking regulators have already contacted lenders to discuss exposure and response to the Binance incident. A key concern for bitcoin market observers is how much of the remaining 192 million XRP will ultimately be swapped for bitcoin, and whether subsequent attempts to cash out these funds will succeed.
Investigators and protocol operators are closely monitoring whether bridges like THORChain can continue blocking attacker-linked addresses in time to slow the ongoing conversion process. The next phase will determine if yet more XRP, and eventually ether, is routed through similar mechanisms as the original $50 million transferred into bitcoin.
