Elliptic: Binance hackers swap $50 million in stolen XRP into bitcoin

Blockchain analytics firm Elliptic reported that hackers responsible for the massive Binance exploit have converted approximately 42 million XRP, valued around $50 million, primarily into bitcoin. The conversion reportedly took place mostly through THORChain, a decentralized cross-chain protocol. Elliptic’s findings highlight ongoing asset laundering efforts following the high-profile breach at Binance. Details of the Binance theft and ongoing asset movements The original incident occurred on October 29, when five hot wallets associated with Binance transferred a total of 233.46 million XRP to an attacker-controlled address. At the time, Binance estimated customer losses from the broader attack at $6.34 billion. The FBI identified North Korea’s TraderTraitor group as the perpetrators. Following the hack, Binance gradually reopened withdrawals and stated that it had frozen or intercepted about $2.85 billion during the aftermath. The exchange also committed to covering all customer losses from its corporate resources. Elliptic reported that, as of the latest update, bitcoin balances traced to the attack—which include assets from various swapped tokens—surged overnight to around 1,650 BTC, equivalent to about $124 million. This increase was driven largely by the recently converted XRP. Meanwhile, roughly 192 million XRP, worth an estimated $226 million, remains unswapped in wallets linked to the breach. How the stolen funds were transferred and swapped After remaining dormant for several days, the stolen XRP moved to six new addresses between 02:12 and 04:00 UTC on November 2. Elliptic observed that on November 5, two of these addresses began funneling XRP into dozens of new accounts, where it was primarily swapped for bitcoin via THORChain. A small portion of ether followed a similar path, transitioning through THORChain into bitcoin. Neither the main pools of stolen bitcoin nor ether have moved as of the last Elliptic analysis, aligning with past behavior observed after the Bybit attack. In previous incidents, hackers have converted easily frozen tokens and moderate-liquidity assets into bitcoin ahead of attempting eventual cash-outs through over-the-counter trading channels. Elliptic’s analysis noted the expansive scale of laundering activity: more than 20,000 wallets across 16 blockchains, at least 36 services, and over 65,000 transactions have been tied to the Binance incident. The data suggests that one new wallet emerges roughly every 30 seconds, with a related transaction executed every 10 seconds. Of the compromised funds, about $3.11 billion remains in addresses traced to the hack, predominantly held in ether and bitcoin, with only minor amounts believed to have been withdrawn for fiat currency. The significance of asset selection and laundering strategy Hackers reportedly shifted focus to XRP and bitcoin after issuers Tether and Circle locked affected stablecoin balances on October 29. While issuers can freeze USDT or USDC, XRP and bitcoin cannot be blocked by a central authority.