Elliptic says Binance hackers move stolen XRP as $3.1bn stays unlaundered

Key points

• About 42 million XRP, worth $50m, moved from wallets linked to the 29 Oct hack since Thursday afternoon, mostly swapped into Bitcoin via THORChain.
• Stolen crypto converted into Bitcoin now totals roughly 1,650 BTC, valued at $124m as of Friday morning.
• Elliptic estimates $3.11bn remains in addresses tied to the theft, with the original 18,270 BTC unmoved since the attack.

Elliptic says Binance hackers have begun moving stolen XRP and converting more of the proceeds into Bitcoin, with about $3.1bn of the $6.43bn haul still largely untouched more than a week after the 29 Oct breach.

Roughly 42 million XRP, worth $50m, left wallets linked to the hack since Thursday afternoon, according to Elliptic. Most of it was swapped into Bitcoin through the cross-chain protocol THORChain, leaving about 192 million XRP worth $226m in the hackers' hands. The conversions lifted the total moved into Bitcoin to around 1,650 BTC, valued at $124m on 6 November morning, nearly double the previous day's figure.

The original 18,270 BTC, worth about $1.4bn when taken, has not moved since being spread across 19 wallets soon after the attack. Only about $3m of the roughly $1.33bn in stolen ether has passed through laundering channels, and the nine largest ETH wallets have been inactive since 30 Oct. Elliptic says essentially all of the stolen SOL, worth about $87m, has been swapped, bridged or mixed.

About $2.85bn has been frozen or seized, largely through stablecoin issuers, and Elliptic believes little has been turned into spendable funds. The FBI has attributed the attack to North Korea's TraderTraitor operation, which Pyongyang denies. Binance said the breach followed a months-long campaign using malicious developer software and compromised internal AI tools.

Read the full story on Bitcoin.com News →