Binance hack: $50 million in stolen XRP swapped mostly into Bitcoin
The stolen XRP has started to move, but swapping it into Bitcoin doesn’t mean it has already been turned into cash.
Bitcoin (BTC) today
€61,112
−2.2% in 24h
Price and chart
About 42 million XRP, worth nearly $50 million, from the Binance hack have been swapped mostly into Bitcoin via THORChain, according to an Elliptic update through November 6, 2026. The total Bitcoin obtained from swapping other stolen assets reached about 1,650 BTC, worth $124 million, nearly doubling in a single day.
How did the stolen XRP move?
The XRP swaps began after the funds had sat for days in the attackers’ addresses. According to Elliptic, on October 29, between 20:05 and 20:09 UTC, five Binance hot wallets sent a total of 233.46 million XRP to an attacker’s address.
On November 2, between 02:12 and 04:00 UTC, about 233 million XRP were moved to six new addresses. From the afternoon of November 5, two of them began funding dozens of new accounts, which were used to carry out the swaps, mainly on THORChain, a protocol for swapping between different blockchains.
About 192 million XRP, worth $226 million, had still not been swapped. Binance put the total theft at $6.34 billion, while the FBI attributed the operation to the North Korean group TraderTraitor.
What do the 1,650 BTC mean?
The 1,650 BTC refers to all the Bitcoin acquired by swapping other stolen assets, not just the $50 million in XRP. Most of the recent increase came from the XRP route, while a small amount of ether was also swapped via THORChain.
Two things need to be kept apart here: swapping one coin for another is not the same as cashing out. Elliptic estimates that only a negligible amount has likely been cashed out so far. The main Bitcoin and ether holdings from the original theft are still sitting untouched.
Why are the attackers converting the funds into Bitcoin?
The conversion into Bitcoin follows a pattern Elliptic also observed after the Bybit hack: first, assets that can be frozen or have lower liquidity are swapped, and later the attackers try to cash out through over-the-counter (OTC) brokers.
Issuers can freeze many stablecoins, i.e. coins designed to track a reference value. Tether and Circle froze large amounts on October 29. XRP and Bitcoin have no equivalent issuer freeze mechanism. That doesn’t make them invisible, but it makes recovery harder once the funds are scattered across new addresses.
The scale is already large: Elliptic has logged more than 20,000 wallets across 16 blockchains, at least 36 services and 65,000 transactions. About $3.11 billion remained in linked addresses, mostly in ether and Bitcoin.
What are we watching from here?
The key question is whether the remaining XRP will continue to be swapped and whether the large ether holdings will move. We are also watching how effectively exchange services and cross-chain bridges block the attackers’ published addresses.
Binance has gradually reopened withdrawals and says it has frozen or intercepted about $2.85 billion, covering customer losses from its own funds.
In our view, for readers in Greece the key point is the difference between tracing and recovery: seeing the money move doesn’t mean it can easily be returned. Nor do these swaps, on their own, point to any particular direction for the price of Bitcoin or XRP.
Sources: Bitcoin Magazine and The Defiant, based on Elliptic’s findings.