Attackers linked to the Binance theft have converted about $50 million in stolen XRP, mostly into bitcoin, according to blockchain analytics firm Elliptic. The transfers add a new stage to a sprawling laundering operation while the largest stolen bitcoin and ether holdings remain largely untouched.
XRP begins moving through cross-chain swaps
Bitcoin Magazine reported that roughly 42 million XRP had been exchanged, largely through the cross-chain service THORChain. Elliptic said the conversion left about 192 million XRP, valued at roughly $226 million, in addresses associated with the theft.
Bitcoin obtained by converting stolen assets rose to about 1,650 BTC, worth approximately $124 million, according to the outlet. Most of the increase came through the XRP route, although a small amount of ether was also converted through THORChain.
The route from Binance wallets to new accounts
Bitcoin Magazine reported that five Binance hot wallets sent 233.46 million XRP to an attacker address between 20:05 and 20:09 UTC on October 29. The XRP was among the assets taken in the wider breach.
Elliptic told Bitcoin Magazine that approximately 233 million XRP moved into six new addresses early on November 2 and remained there until November 5. From that afternoon, two of those addresses sent XRP onward to dozens of accounts that carried out swaps, mostly into bitcoin through THORChain.
Cross-chain services can allow an asset on one blockchain to be exchanged for an asset on another. Following the trail therefore requires monitoring both the original XRP addresses and the destinations of the resulting bitcoin.
Most major bitcoin and ether holdings remain parked
Decrypt reported that wallets associated with the theft still held approximately $3.11 billion, primarily in bitcoin and ether. Elliptic said those funds were very likely still held by North Korea, according to the outlet.
Decrypt gave a more detailed account of the largest holdings. According to Decrypt, the stolen 18,270 BTC was split between 19 addresses on the day of the theft and remained there. Decrypt reported that 89% of the attacker's ether was held in nine leading Ethereum addresses, with no transfers from them since October 30.
The Defiant also reported the XRP conversion and the rise to 1,650 BTC obtained from other stolen assets. Its summary likewise said the main ether and bitcoin holdings remained untouched.
Frozen assets and the wider laundering trail
Decrypt reported that $2.85 billion of the stolen assets had been frozen or seized, mostly stablecoins. It said issuers including Tether and Circle froze stablecoins shortly after the theft. Bitcoin Magazine said Binance had frozen or intercepted about $2.85 billion and was covering customer losses with its own funds.
Both outlets reported that Elliptic had traced at least 65,000 transactions involving more than 20,000 wallets, with activity spanning 16 blockchains and at least 36 services. Decrypt described about $220 million in TRX moving through Tron, with almost all of it bridged to Ethereum. Both outlets reported that all of the stolen Solana, valued at about $87 million, had been swapped, bridged or mixed.
Decrypt also reported that about 33 BTC had entered Wasabi-style coinjoins and approximately $1.1 million in ether and SOL had entered the Privacy Cash pool. Coinjoins combine transactions, making it harder to trace individual flows, while blockchain monitoring can still identify activity linked to known addresses.
Accounts differ on the size of the theft
The outlets give different figures for the overall loss. Bitcoin Magazine said Binance later put the theft at $6.34 billion, while Decrypt described $6.43 billion as stolen. Their reports agree on the approximate value of the XRP converted and the amount still held in addresses linked to the theft.
Both outlets said the FBI attributed the October 29 campaign to a North Korean group known as TraderTraitor. Decrypt also reported that North Korea denied involvement.
Elliptic assessed the laundering as automated, but found no evidence that an artificial intelligence agent was making decisions, Decrypt reported. Bitcoin Magazine described fixed timing, set amounts and repeated attempts as features behind that assessment.
Address monitoring and withdrawal restoration
The remaining XRP addresses and the parked ether holdings are important points to monitor for further conversions. Bitcoin Magazine reported that Elliptic had seen a similar sequence after the Bybit hack, when assets were converted into bitcoin before later attempts to cash out through over-the-counter brokers.
Whether THORChain operators and other bridges can block published attacker addresses quickly enough to slow further transfers remains open. Address-level monitoring may also show whether the larger bitcoin and ether holdings begin moving.
For Binance users, Decrypt reported that the exchange had restored a proof-of-reserves verification tool showing balances backed at least 1:1. Decrypt reported that Binance aimed to make withdrawals available again for every token on restored networks before the following week ended.
Market snapshot
| Asset | Price | 24h | 7d | Market cap |
|---|---|---|---|---|
| Bitcoin (BTC) | $75,653 | -2.5% | -2.2% | $1.52 trillion |
| Ethereum (ETH) | $2,226 | -3.5% | +0.1% | $272.03 billion |
| XRP (XRP) | $1.19 | -6.4% | -4.6% | $75.40 billion |
| TRON (TRX) | $0.317967 | +0.3% | -4.7% | $30.22 billion |
| NEAR Protocol (NEAR) | $3.78 | -1.5% | -12.2% | $4.96 billion |
CoinGecko data as of 2026-11-06 (UTC).
FAQ
How much stolen XRP has been converted into bitcoin?
Bitcoin Magazine reported that about 42 million XRP, worth roughly $50 million, had been swapped, mostly into bitcoin through THORChain. About 192 million XRP, worth roughly $226 million, remained in addresses linked to the theft.
Have the largest assets stolen from Binance moved?
Decrypt reported that the 18,270 BTC stolen from Binance had not moved after being split among 19 addresses on the day of the hack. Decrypt also reported no transfers since October 30 from the nine leading Ethereum addresses, which held 89% of the attacker's ether.
How much of the stolen crypto has been frozen or seized?
Decrypt reported that $2.85 billion had been frozen or seized, mostly in stablecoins. Bitcoin Magazine said Binance had frozen or intercepted about $2.85 billion and was covering customer losses from its own funds.
Sources
- Bitcoin Magazine: Binance Hackers Swap About $50 Million of Stolen XRP Mostly Into Bitcoin, Elliptic Says (2026-11-06)
- Decrypt: $3.1B in Stolen Binance Crypto Has Yet to Be Laundered: Elliptic (2026-11-06)
- The Defiant: Binance Hackers Swap $50 Million in XRP, Mostly Into Bitcoin, Elliptic Says (2026-11-06)
- CoinGecko (market data)
Written by the Coinvote news desk from reporting by Bitcoin Magazine, Decrypt and The Defiant. Not financial advice.
