Binance Hackers Swap $50M in Stolen XRP for Bitcoin via THORChain
Hackers tied to the October 29 record $6.34 billion theft from Binance have converted about $50 million of stolen XRP mostly into bitcoin via THORChain, blockchain analytics firm Elliptic reported. While market pricing for XRP reflects short-term negative sentiment and prediction markets track future price movements, issuers locked down large stablecoin tranches immediately after the breach, forcing the attackers to prioritize assets sitting outside freeze mechanisms like XRP and bitcoin.
Stolen XRP Moves to New Addresses and Turns into Bitcoin
The stolen digital assets sat quiet at first. Early on November 2, between 02:12 and 04:00 UTC, roughly 233 million XRP moved into six new addresses where it stayed until November 5. From the afternoon of November 5, two of those six addresses began sending XRP on to dozens of new accounts. Those accounts swapped about 42 million XRP—roughly $50 million—mostly through THORChain into bitcoin, according to Elliptic.
The total volume of bitcoin obtained from other stolen funds surged by roughly 100% overnight, reaching about 1,650 BTC valued at some $124 million. Most of that jump came from the XRP route. Meanwhile, about 192 million XRP, roughly $226 million, remained unswapped in addresses linked to the Binance theft. The main bitcoin and ether holdings from the theft have still not moved.
This activity highlights ongoing efforts to move assets that cannot be frozen by issuers. Tether and Circle locked down large tranches of stablecoins on October 29. Because issuers cannot freeze XRP or bitcoin the same way, the attacker shifted focus.
Laundering Scale Across Blockchains
The broader laundering trail spans more than 20,000 wallets across 16 blockchains. Elliptic tracked at least 36 services and at least 65,000 transactions, averaging one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses linked to the Binance theft, mostly held as ether and bitcoin. A negligible amount has been cashed out so far.
Other assets from the October 29 breach moved with similar speed. All stolen Solana, amounting to about $87 million, was swapped, bridged, or mixed, with much of it ending as bitcoin. Most early Tron laundering, totaling about $220 million in TRX, has also run its course. Bitcoin Magazine covered this flow alongside the quiet shutdown of the T3 Financial Crime Unit before the hack.
Some converted bitcoin entered Wasabi-style coinjoins—about 33 BTC, or $2.5 million, since November 1. Prior to the cessation of deposits on the Privacy Cash platform, approximately $1.1 million worth of ether and SOL found its way into the pool.
FBI Blames North Korea as Binance Freezes Funds
The FBI attributed the campaign to North Korea’s TraderTraitor group. Binance reopened withdrawals in stages and reported freezing or intercepting about $2.85 billion while covering customer losses from its own funds. U.S. bank supervisors have already checked in with lenders following the breach.
Elliptic noted that the speed of the transfers points to conventional automation rather than an AI agent making live decisions. Fixed timing, set amounts, blind retries, and new tactics introduced hours apart characterize the laundering pattern. This matches what Elliptic saw after the Bybit hack.
The immediate test for protocols is whether THORChain operators and other bridges keep blocking published attacker addresses fast enough to slow the XRP-to-bitcoin pipe. Observers continue monitoring legal and regulatory responses from Binance and other involved entities.