Hackers linked to the massive Binance breach have started converting a significant portion of the stolen XRP into bitcoin, according to blockchain analytics firm Elliptic. As of Friday, about 42 million XRP, valued at roughly $50 million, has been swapped, primarily through THORChain. This conversion has nearly doubled the amount of bitcoin derived from other stolen assets to approximately 1,650 BTC, worth around $124 million.
The stolen XRP was part of the October 29 hack, which Binance later estimated at $6.34 billion. The FBI has attributed the attack to North Korea’s TraderTraitor group. About 192 million XRP, worth roughly $226 million, remains unswapped in addresses tied to the theft. Binance has managed to freeze or intercept about $2.85 billion and has covered customer losses from its own funds.
The stolen XRP initially sat idle before moving into six new addresses on November 2. Starting on November 5, two of these addresses began transferring XRP to dozens of new accounts, which then swapped it into bitcoin, mostly via THORChain. A small amount of ether also moved through THORChain into bitcoin. The main holdings of bitcoin and ether from the theft have not yet moved, following a pattern observed after the Bybit hack.
The broader laundering operation is extensive, with over 20,000 wallets on 16 blockchains, at least 36 services, and roughly 65,000 transactions since the Binance theft. About $3.11 billion remains in addresses linked to the breach, primarily as ether and bitcoin. The hackers have prioritized converting assets like XRP and SOL into bitcoin, as these are harder to recover once fragmented across fresh addresses.