Hackers Swap About $50 Million of Stolen XRP Into Bitcoin, Elliptic Says

Hackers who drained $6.4 billion from Binance have started converting the stolen XRP into bitcoin. About 42 million XRP, roughly $50 million, has been swapped since the afternoon of Nov. 5, mostly through the THORChain cross-chain service, blockchain analytics firm Elliptic said in an update published Nov. 6. About 192 million XRP, around $226 million, remains in addresses linked to the theft, the update shows.

The XRP first moved on Nov. 2, when all 233 million tokens went to six new addresses between 02:12 and 04:00 UTC and sat there until Nov. 5, according to the update. Two of those six addresses then sent the tokens on to dozens of new accounts, and those accounts swapped them into bitcoin, mostly through THORChain. A small amount of ether went the same route that evening. The main bitcoin and ether holdings from the theft, the largest pools, have still not moved.

Converted bitcoin from all stolen assets reached about 1,650 BTC, or $124 million, by 08:45 UTC on Nov. 6, almost double the figure a day earlier, and most of the overnight increase came from the XRP route, the update said.

The XRP was part of the Oct. 29 drain. Between 20:05 and 20:09 UTC that day, five Binance hot wallets sent 233.46 million XRP to an attacker address, Bitcoin Magazine reported. Binance later put the total loss at $6.34 billion, while Elliptic's page puts the theft at $6.43 billion across 11 blockchains. The FBI attributed the campaign on Oct. 31 to North Korea's TraderTraitor group and published the attacker's addresses.

Stablecoin issuers moved faster. Tether froze the stolen USDT 37 minutes after it arrived, and Circle froze all 823 million stolen USDC before any of it could be swapped, the update said. In total, $2.85 billion, or 44 percent of the haul, has been frozen or seized. Decrypt reported that only about 3 percent was frozen after the $1.5 billion Bybit hack in February 2025. Issuers can freeze many stablecoins, but they cannot freeze XRP the same way, and they cannot freeze bitcoin. After Tether and Circle locked down large stablecoin tranches on Oct. 29, the attacker prioritized assets outside the issuers' reach, Bitcoin Magazine noted.

The laundering has touched more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions, roughly one new wallet every 30 seconds, the update said. About $3.11 billion remains in addresses linked to the theft, mostly ether and bitcoin, and the firm said those funds are very likely still held by North Korea. A negligible amount has probably been cashed out so far.

The speed of the transfers has prompted speculation that AI agents are moving the funds, but the firm said the evidence points to conventional automation: fixed timing, set amounts, blind retries and new tactics introduced hours apart. "The laundering is clearly automated, but nothing we have seen shows an AI agent making decisions," the update said.

Some of the coins have been mixed. About 33 BTC, worth around $2.5 million, has gone through Wasabi-style coinjoins since Nov. 1, and about $1.1 million in ether and SOL entered the Privacy Cash privacy pool before that service paused deposits. All of the stolen SOL, about $87 million at current prices, has been swapped, bridged or mixed, much of it ending as bitcoin.

After the Bybit hack in February 2025, North Korea laundered all 499,000 stolen ether within 10 days and took months to cash the proceeds out, the update noted. The report expects the attacker to swap the remaining ether for bitcoin in many small transactions and then cash out through over-the-counter brokers over months.

Binance has reopened withdrawals in stages and said it has frozen or intercepted about $2.85 billion while covering customer losses from its own funds, according to Bitcoin Magazine. On Friday the exchange said users can verify that balances are backed at least 1:1 through the zero-knowledge proof in its latest proof-of-reserves snapshot, and it aims to reopen withdrawals for all tokens on restored networks by the end of next week.