Binance Hack Proceeds Shift Into Bitcoin as $50M of Stolen XRP Is Swapped

Elliptic reports that about 192 million XRP, roughly $226 million, remained unswapped in theft-linked addresses. The firm also says the largest pools of stolen bitcoin and ether have not moved. A small amount of ether also went through THORChain into bitcoin on the evening of November 5.

Scale of the Laundering Network

Since the theft, Elliptic has counted more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions, which it characterizes as roughly one new wallet every 30 seconds and one transaction every 10 seconds. Elliptic estimates about $3.11 billion remains in theft-linked addresses, mostly as ether and bitcoin, and says a negligible amount has likely been cashed out so far.

The pattern resembles what Elliptic observed after the Bybit hack: convert freezable or mid-liquidity tokens into bitcoin first, then attempt cash-out later through over-the-counter brokers. Stablecoin issuers can freeze many of their tokens, but neither XRP nor bitcoin can be frozen in the same way, which Elliptic cites as part of the attacker's logic.

Other Assets and Privacy Routes

Elliptic says all of the stolen SOL, about $87 million at its prices, has already been swapped, bridged or mixed, with much of it ending as bitcoin. Most early Tron laundering, about $220 million in TRX, has also run. Some converted bitcoin, about 33 BTC or $2.5 million since November 1, has entered Wasabi-style coinjoins, and about $1.1 million in ether and SOL entered the Privacy Cash pool before that service paused deposits.

Elliptic said the speed of the activity points to conventional automation rather than an AI agent making live decisions, citing fixed timing, set amounts, blind retries and new tactics introduced hours apart. Binance, for its part, says it has reopened withdrawals in stages and has frozen or intercepted about $2.85 billion while covering customer losses from its own funds.

Regulatory and Market Questions

U.S. bank supervisors have already contacted lenders following the Binance breach, though the sources do not detail the outcome of those contacts. For bitcoin markets, the near-term questions are how much of the remaining XRP, and eventually the parked ether, is converted before any cash-out attempt. Whether THORChain operators and other bridges continue blocking published attacker addresses quickly enough to slow the XRP-to-bitcoin flow is the key operational test.

Why It Matters

For Traders

Bitcoin inflows from the swaps could add near-term selling pressure if the attacker cashes out through OTC brokers, though timing is uncertain and no cash-out has been confirmed.

For Investors

The episode highlights concentrated custody and hot-wallet risk at major exchanges, a factor that may shape how institutions weigh counterparty exposure in the sector.

For Builders

Bridges and swap services face ongoing pressure to screen and block flagged addresses in real time, which affects how cross-chain routing and compliance tooling should be designed.