Hackers tied to the October 29 Binance theft have converted approximately 42 million XRP, worth roughly $50 million, into bitcoin mostly through THORChain, according to blockchain analytics firm Elliptic. The conversion brought stolen bitcoin holdings from other assets to about 1,650 BTC, valued near $124 million, with the XRP swap accounting for most of that increase overnight.
About 192 million XRP, roughly $226 million, remains unswapped in addresses linked to the breach. The original theft pulled 233.46 million XRP across five hot wallets on October 29. The FBI has attributed the campaign to North Korea's TraderTraitor group. Binance has frozen or intercepted about $2.85 billion of stolen funds while covering customer losses from its own reserves.
The stolen XRP moved into six new addresses on November 2, then began routing to dozens of accounts starting November 5 that swapped it for bitcoin. This pattern mirrors the Bybit hack response: convert freezable tokens into bitcoin first, then attempt cash-out later through over-the-counter brokers.
Elliptic has tracked more than 20,000 wallets across 16 blockchains involved in laundering the stolen assets, detecting at least 65,000 transactions and roughly one new wallet every 30 seconds. About $3.11 billion remains in addresses tied to the theft, mostly as ether and bitcoin, with negligible amounts cashed out so far.
The attacker prioritized XRP and bitcoin because issuers cannot freeze them the way they can freeze stablecoins. After Tether and Circle locked down large stablecoin amounts on October 29, the attacker shifted to unfrozen assets. All stolen SOL, about $87 million, has already been swapped or mixed, with much becoming bitcoin. Most early Tron laundering, roughly $220 million in TRX, has also moved.
Some converted bitcoin entered coinjoins, with about 33 BTC, or $2.5 million, sent through Wasabi-style mixers since November 1. Elliptic said the conversion speed and patterns point to automation rather than live decision-making, with fixed timing, set amounts, and new tactics introduced hours apart. The remaining question is how much of the unswapped 192 million XRP converts to bitcoin before any cash-out attempt.