Binance hack: $50M of stolen XRP swapped, mostly into bitcoin, as $226M remains

How the XRP moved

Bitcoin Magazine's account of the Elliptic update says five Binance hot wallets sent 233.46 million XRP to an attacker address between 20:05 and 20:09 UTC on October 29. That is 04:05 to 04:09 SGT on October 30. Elliptic's timeline picks up from there.

By our arithmetic, 42 million out of 233.46 million is about 18% of the stolen XRP. So roughly four-fifths has yet to take the route. Elliptic's rounded figures add up to 234 million, a touch above the starting amount, so treat all of these as approximate.

Odaily carried the same $50 million and $226 million figures at 19:17 SGT, and ChainCatcher followed minutes later. All of them trace back to Elliptic, so they confirm that the report exists. They are not separate on-chain measurements.

Why the stolen funds keep ending up in bitcoin

Elliptic counts about 1,650 BTC, worth about $124 million, sitting in new bitcoin addresses after conversion from other stolen assets. That is almost twice the figure from a day earlier, and most of the overnight increase came from XRP swapped through THORChain. The count was 215 BTC on the afternoon of November 3 and 470 BTC on the morning of November 4.

Tether and Circle froze stablecoins within the first hours, so the thief's first priority was swapping into assets that nobody can lock. Bitcoin Magazine puts the logic plainly: issuers can freeze many stablecoins, they cannot freeze XRP the same way, and they cannot freeze bitcoin. Elliptic sees the same pattern as the Bybit case of February 2025, when North Korea laundered all 499,000 stolen ETH within ten days, mostly by swapping it for bitcoin. Cashing out then took months.

The October 29 numbers show why speed mattered. Elliptic says $3.46 billion of the theft, or 54%, was in stablecoins, and Tether froze the stolen USDT on Ethereum 37 minutes after it arrived. Before that freeze the attacker swapped 434 million USDT for ETH on decentralized exchanges and, on Tron, 234 million USDT for TRX. Circle froze all 823 million stolen USDC before any of it was swapped. Around $786 million of stablecoins was converted in time.

SOL then showed the template that XRP is now following. Batches were sold for USDC, bridged to Ethereum, swapped for ETH and then swapped into bitcoin, each within about an hour, and one batch crossed four blockchains in under five hours.

THORChain sits at the centre of this route. It halted swaps on most of its networks at 19:34 SGT on October 31 (11:34 UTC) after a technical fault, and our report on its restart covered the return of swaps on ten networks. Elliptic says swaps resumed late on November 3. On the evening of October 31, the FBI published the attacker's addresses and urged THORChain node operators to block them. The first $50 million of XRP went through regardless, though Elliptic's report does not say how much was blocked along the way.

Where the $6.43 billion sits now

Elliptic puts the theft at $6.43 billion. Bitcoin Magazine says Binance later gave a figure of $6.34 billion. We could not reconcile the two, so the table uses Elliptic's numbers throughout.

Elliptic counts more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions since the theft. It reads the pace as conventional automation, with fixed timing, set amounts and blind retries, and says nothing it has seen shows an AI agent making decisions.

The $3.11 billion is lower than the $3.24 billion we reported on November 2. Elliptic values the remaining funds at prices from about 15:55 SGT on November 6 (07:55 UTC), so that change is not a count of coins that left.

Mixing is still small next to the totals. About 33 BTC, or $2.5 million, has gone through Wasabi-style coinjoins since November 1, and about $1.1 million in ETH and SOL entered the Privacy Cash pool. Around $16 million went to addresses that also hold proceeds of the September 2026 Bitget exploit, which Elliptic also believes was the work of TraderTraitor. The FBI attributed the Binance theft to that North Korean group.

What the XRP chart does and does not show

XRP is weaker than bitcoin today. OKX's public XRP-USDT ticker showed $1.1937 at 00:41 SGT on November 7, against a 24-hour opening price of $1.2499, a fall of about 4.5%. BTC-USDT on OKX showed $75,714.9 against $76,642.7, a fall of about 1.2%.

No source we opened links that gap to the swaps, and we are not claiming a link. The sizes help you judge it yourself. Our liquidations and market data recorded $960.8 million of XRPUSDT perpetual turnover on Binance over the past 24 hours, at 00:38 SGT on November 7. On that scale, the $50 million already swapped is about 5% of one venue's one-day perpetual turnover, and the $226 million still waiting is about 24%. The swaps also ran through THORChain over many accounts, not through that order book.

The funding rates page showed XRP at 0.0047% on Binance and 0.0036% on OKX per funding interval in the same snapshot. Both are positive and below BTC's 0.0093% and 0.0045%. At those rates longs paid shorts a small amount. Our feed also recorded $6.34 million of XRPUSDT liquidations over 24 hours, out of $232.9 million observed in total.

What this means for you

• Check your XRP on Binance in your own account screen. Open the wallet page and confirm the balance and whether deposits and withdrawals are open for your network. Bitcoin Magazine reports that Binance has reopened withdrawals in stages and says it is covering customer losses from its own funds. Elliptic's update follows the thief's wallets and has no bearing on an individual balance.
• Avoid any message offering "Binance compensation" or asking you to connect a wallet because of this hack. Use only the official app or site.
• If you trade XRP perpetuals on Binance or OKX, check your liquidation price and funding before the next settlement. XRP has already fallen about 4.5% in 24 hours on OKX, and nothing tells you when the remaining 192 million XRP will move.
• If you buy XRP or BTC off an exchange, keep the sending transaction hash and the seller's details. Elliptic says customers can screen against nearly 18,000 addresses linked to the theft and that centralized services are where these funds can be stopped, so a later deposit may be checked against that list.

What Elliptic expects next

Elliptic expects the ETH to be swapped for bitcoin in many small transactions and then sold through over-the-counter brokers over months. The main ETH and BTC holdings have not moved. Those funds are very likely still held by North Korea, the firm says, while the funds being laundered may already be with Chinese money laundering networks. On-chain data cannot show which.

Further freezes will be harder. Elliptic notes that 44% of the stolen funds were frozen, against around 3% after Bybit. Its best remaining chances are stablecoins caught briefly in transit and centralized services at the point of cash-out. A negligible amount has likely been cashed out so far, because the thief still needs a counterparty to turn these coins into money it can spend.

The next data point to watch is the 192 million XRP figure in Elliptic's next update, along with any movement in the nine large addresses that hold 89% of the attacker's ETH.

What we could not confirm

• How much XRP THORChain node operators or other services blocked. Elliptic does not give a figure.
• Whether the XRP sale pressure, if any, reached exchange order books. No source we opened measures this.
• Which of $6.43 billion and $6.34 billion is the better total. The first is Elliptic's and the second is Bitcoin Magazine's report of the Binance figure.

Quick answers

Can the stolen XRP still be frozen?

Bitcoin Magazine says issuers cannot freeze XRP the way they freeze stablecoins. Elliptic's remaining hopes for further freezes are stablecoins in transit and centralized services when funds are cashed out.

Has the thief sold the XRP for cash?

Not in any measurable way so far. About 42 million XRP has left and been swapped, mostly into bitcoin, and Elliptic says a negligible amount of the overall theft has likely been cashed out.

Does this change anything for my Binance balance?

The report tracks the thief's wallets. Check your balance and withdrawal status in your own Binance account, and see our earlier coverage of Binance's return request for a related record check.