Elliptic: About $50 Million in Stolen XRP Has Been Swapped Mostly Into Bitcoin

XRP conversions add to the stolen bitcoin pool

Hackers linked to the Binance theft have converted about 42 million XRP, worth roughly $50 million, mostly into bitcoin through THORChain, according to blockchain analytics firm Elliptic. The firm’s update, covering activity through Friday, says the swaps drove most of an overnight increase in bitcoin derived from the stolen assets. That converted bitcoin balance reached about 1,650 BTC, valued at approximately $124 million.

The XRP conversion is a portion, not the full amount taken. Elliptic identified about 192 million XRP, worth roughly $226 million, still unswapped in addresses linked to the theft. The XRP was among assets removed during the Oct. 29 incident, which Binance later valued at $6.34 billion. The difference between the converted and remaining amounts indicates that the XRP movement is ongoing, but does not establish how much will be moved next.

The theft’s XRP transfers began within a short window on Oct. 29. Between 20:05 and 20:09 UTC, five Binance hot wallets sent 233.46 million XRP to an attacker address, according to the account in the report. The FBI has attributed the wider campaign to North Korea’s TraderTraitor group. Binance has reopened withdrawals in stages and said it froze or intercepted about $2.85 billion, while covering customer losses from its own funds.

The XRP moved in stages after several quiet days

The stolen XRP did not immediately flow into conversion services. Elliptic says that early on Nov. 2, between 02:12 and 04:00 UTC, about 233 million XRP moved into six newly created addresses. Those funds then remained there until Nov. 5. This pause separated the initial transfer from the later swaps, and shows why the theft’s chronology matters: the XRP’s movement unfolded over several days rather than as one continuous transaction.

From the afternoon of Nov. 5, two of the six addresses began distributing XRP to dozens of new accounts. Those accounts then swapped the tokens, mostly through THORChain into bitcoin. Elliptic also recorded a small amount of ether routed through THORChain into bitcoin that evening. The pattern places the XRP swaps within a broader effort to move stolen assets across services and into different forms, rather than simply transferring the original tokens between wallets.

Not all major holdings have followed that route. Elliptic says the largest pools of bitcoin and ether associated with the theft have not moved, while only small portions of the main ether and NEAR holdings have been transferred. This leaves a distinction between assets already converted and substantial holdings still parked. The report does not say when, or whether, those unmoved balances will be transferred, so the current XRP activity cannot be treated as a timetable for the rest.

A sprawling trail spans wallets, chains and services

Elliptic has counted more than 20,000 wallets across 16 blockchains in the laundering trail since the Binance theft. The firm also identified activity involving at least 36 services and at least 65,000 transactions. Put another way, its figures correspond to roughly one new wallet every 30 seconds and one transaction every 10 seconds. The scale describes a dispersed, multichain trail; it does not by itself show that each wallet or service represents a separate participant.

Despite the extensive movement, Elliptic estimates that about $3.11 billion remains in addresses linked to the theft, mostly as ether and bitcoin. The firm says only a negligible amount has likely been cashed out so far. That distinction matters: moving assets between wallets or swapping one token for another is not the same as converting them into conventional money. The reported trail therefore shows substantial laundering activity alongside limited evidence of completed cash-outs.

Elliptic says the movement also reflects differences in how assets can be frozen. Issuers can freeze many stablecoins, but cannot freeze XRP in the same way or freeze bitcoin. After Tether and Circle locked down large stablecoin tranches on Oct. 29, the attacker prioritized assets outside that issuer-controlled mechanism, according to the report. Converting XRP into bitcoin continues that pattern, although the source does not claim that bitcoin becomes impossible to trace or recover.

The next question is whether the conversion route continues

The current XRP activity is part of a wider sequence of conversions. Elliptic says all of the stolen SOL, about $87 million at its prices, has been swapped, bridged or mixed, with much ending as bitcoin. Most early laundering of about $220 million in TRX has also run, while only small portions of the main ether and NEAR pools have moved. These figures show different stages across asset groups, rather than a single uniform route for all of the stolen funds.

Some converted funds have also entered privacy-oriented services. Elliptic counted about 33 BTC, valued at roughly $2.5 million, sent into Wasabi-style coinjoins since Nov. 1. It also reported about $1.1 million in ether and SOL entering the Privacy Cash pool before that service paused deposits. These are limited portions of the broader trail, and the report does not establish that the services received all converted assets or that the funds were successfully cashed out.

Elliptic interprets the speed and regularity of the activity as conventional automation rather than an AI agent making live decisions, citing fixed timing, set amounts, blind retries and tactics introduced hours apart. What happens next remains unclear: the key near-term question is whether more of the roughly 192 million XRP is converted, and whether parked ether later moves. The report also leaves open whether THORChain operators and other bridges can keep blocking published attacker addresses quickly enough to interrupt the route.

Source: BitcoinMagazine