Hackers linked to the October theft from Binance have converted approximately 42 million XRP, valued at roughly $50 million, into bitcoin, according to an update from blockchain analytics firm Elliptic. The swaps occurred primarily through the decentralized cross-chain protocol THORChain.
The conversion activity increased the total amount of stolen assets transformed into bitcoin to about 1,650 BTC, worth approximately $124 million. Elliptic noted that most of this recent increase resulted from the XRP route. A small amount of ether was also swapped into bitcoin via THORChain during the same period.
Remaining Stolen Assets
Despite the recent movement, a significant portion of the stolen funds remains stationary. About 192 million XRP, valued at roughly $226 million, remains unswapped in addresses linked to the breach. In total, approximately $3.11 billion in stolen assets, held mostly as ether and bitcoin, remains in addresses associated with the theft.
Elliptic reported that the main pools of bitcoin and ether from the theft have not moved. Only small portions of the primary ether and NEAR holdings have been transferred. However, all of the stolen Solana (SOL), valued at about $87 million, has been swapped, bridged or mixed, with much of it ending up as bitcoin. Most of the early Tron laundering flow, involving about $220 million in TRX, has also been processed.
Laundering Techniques
The attackers have employed various methods to obscure the trail of the stolen funds. Since November 1, about 33 BTC, worth $2.5 million, has been sent through Wasabi-style coinjoin transactions. Additionally, approximately $1.1 million in ether and SOL entered the Privacy Cash pool before the service paused deposits.
Since the initial breach, Elliptic has tracked more than 20,000 wallets across 16 blockchains, involving at least 36 services and 65,000 transactions. This activity averages roughly one new wallet every 30 seconds and one transaction every 10 seconds.
Breach Background and Response
The stolen XRP was part of a larger drain on October 29 that Binance valued at $6.34 billion. On that day, between 20:05 and 20:09 UTC, five hot wallets sent 233.46 million XRP to an attacker address. In the early hours of November 2, all of the stolen XRP moved into six new addresses, where it remained until November 5. Starting the afternoon of November 5, two of those addresses began distributing the XRP to dozens of new accounts for swapping.
The FBI has attributed the campaign to North Korea’s TraderTraitor group. In response to the breach, Binance has reopened withdrawals in stages. The exchange stated it has frozen or intercepted about $2.85 billion and is covering customer losses from its own funds. U.S. bank supervisors have also checked in with lenders following the incident.
