Binance Hackers Convert $50 Million of Stolen XRP to Bitcoin
Hackers swap stolen XRP for Bitcoin to avoid freezes
Hackers linked to the multi-billion dollar Binance theft have started converting stolen XRP into Bitcoin. Blockchain analytics firm Elliptic reported that approximately 42 million XRP, worth about $50 million, was swapped recently.
The swaps mostly took place through THORChain, a decentralized protocol that allows users to trade assets across different blockchains. The hackers are moving funds out of XRP, a digital currency, and into Bitcoin, which is the largest and most well-known cryptocurrency. An exchange, like Binance, is a digital platform where people buy and sell these assets.
Significant movements in stolen funds
- The total amount of Bitcoin converted from various stolen assets nearly doubled to approximately 1,650 BTC, valued at $124 million.
- Roughly 192 million XRP, worth about $226 million, remains in digital wallets linked to the theft.
- The FBI has attributed the attack to North Korea’s "TraderTraitor" group.
- Binance has frozen or intercepted about $2.85 billion of the stolen funds so far.
Tracking the laundering process
Elliptic, a firm that monitors blockchain activity, noted that the stolen XRP sat quiet for several days before moving into dozens of new accounts on November 5. This movement follows a pattern where hackers convert assets that can be frozen into Bitcoin, which is much harder for authorities or companies to recover.
Stablecoin issuers like Tether and Circle can "freeze" or lock down specific funds, but they cannot do this for XRP or Bitcoin in the same way. Stablecoins are cryptocurrencies designed to have a stable value, often tied to the U.S. dollar. Because stablecoins were locked down on October 29, the attackers are now focusing on assets that do not have a similar "kill switch."
Details confirmed by Binance and authorities
Binance stated that the total theft on October 29 amounted to $6.34 billion. The exchange has since reopened withdrawals in stages and is using its own funds to cover customer losses. A digital wallet is a tool used to store and manage cryptocurrencies.
The laundering trail has already become vast. Elliptic has identified more than 20,000 wallets on 16 different blockchains and at least 65,000 transactions connected to the event. This averages to about one new transaction every 10 seconds.
Large amounts of crypto remain unmoved
The largest pools of stolen Bitcoin and Ethereum (the second largest cryptocurrency) have not yet been moved. While some assets have been processed through services designed to hide their origin, about $3.11 billion remains in addresses linked to the theft.
The speed of the transactions suggests the hackers are using automated software rather than manual efforts or artificial intelligence to move the money. The process uses fixed timing and blind retries to move funds through various services.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.