Hackers behind the record-setting Binance theft have started converting a large share of their stolen XRP into bitcoin, according to blockchain analytics firm Elliptic, whose latest update runs through Friday. Roughly 42 million XRP — about $50 million — has already been swapped, with most of it routed through THORChain, a decentralized cross-chain swap network that exchanges native assets between blockchains without a central custodian standing in the way.

The conversions pushed bitcoin derived from the hack's other stolen assets up nearly overnight to around 1,650 BTC, worth approximately $124 million, Elliptic reported. Most of that jump came via the XRP route. About 192 million XRP, valued at roughly $226 million, remains unswapped in addresses linked to the theft.

The XRP formed part of the Oct. 29 drain that Binance later sized at $6.34 billion. Between 20:05 and 20:09 UTC that day, five internet-connected hot wallets transferred 233.46 million XRP to an attacker-controlled address. The FBI has attributed the campaign to North Korea's TraderTraitor group, an actor U.S. authorities have previously linked to a series of high-value exchange and bridge thefts. Binance has since reopened withdrawals in stages, said it has frozen or intercepted about $2.85 billion, and is covering customer losses from its own funds.

How the stolen XRP began to move

The stolen XRP initially sat still. Early on Nov. 2, between 02:12 and 04:00 UTC, the entire stash of roughly 233 million XRP shifted into six new addresses, where it remained until Nov. 5, Elliptic said. From the afternoon of Nov. 5, two of those six addresses began forwarding XRP to dozens of fresh accounts that swapped the funds, mostly through THORChain into bitcoin. A small amount of ether also passed through THORChain into bitcoin that evening.

The theft's main bitcoin and ether holdings — the largest pools — have yet to move, Elliptic said. The pattern mirrors what the firm observed after the Bybit hack — the February 2025 breach that drained roughly $1.5 billion in ether from the exchange and was also attributed by the FBI to North Korean hackers: convert freezable and mid-liquidity tokens into bitcoin first, then attempt cash-out later through over-the-counter brokers.

The laundering operation's footprint is already enormous. Since the theft, Elliptic has counted more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions — roughly one new wallet every 30 seconds and one transaction every 10 seconds. About $3.11 billion remains in addresses tied to the breach, mostly in ether and bitcoin, while only a negligible amount has likely been cashed out so far.

Why XRP and Bitcoin Matter Here

Issuers can freeze many stablecoins; they cannot freeze XRP in the same way, and they cannot freeze bitcoin. After Tether and Circle locked down large stablecoin tranches on Oct. 29, the attacker prioritized assets that sit outside that kill switch. Moving XRP into bitcoin extends the same logic: once bitcoin is fragmented across fresh addresses, it becomes far harder to claw back.

All of the stolen SOL — about $87 million at Elliptic's valuations — has already been swapped, bridged or mixed, with much of it ending up as bitcoin. Most of the early Tron laundering, roughly $220 million in TRX, has also run its course; Bitcoin Magazine flagged that flow when reporting on the quiet shutdown of the T3 Financial Crime Unit before the hack. Only small portions of the main ether and NEAR piles have moved.

Some of the converted bitcoin has entered Wasabi-style coinjoins, a mixing technique that pools coins from many spenders to sever traceable links — about 33 BTC, or $2.5 million, since Nov. 1 — while around $1.1 million in ether and SOL flowed into the Privacy Cash pool before that service paused deposits. Elliptic said the pace points to conventional automation rather than an AI agent making live decisions: fixed timing, set amounts, blind retries and new tactics introduced hours apart.

U.S. bank supervisors have already checked in with lenders following the breach. For bitcoin markets, the nearer question is how much more of the remaining ~192 million XRP — and eventually the parked ether — gets turned into BTC before anyone attempts a cash-out.

The test now is whether THORChain operators and other bridges keep blocking the published attacker addresses quickly enough to slow the XRP-to-bitcoin pipeline, or whether the rest of the pile follows the same overnight path the first $50 million already took.

This article is based on a post that first appeared on Bitcoin Magazine and was written by Micah Zimmerman.