Stolen Binance Bitcoin, XRP on the Move as $3.1B Remains Unlaundered: Elliptic

In an investigation updated Friday, Elliptic revealed that astir 42 cardinal XRP, worthy $50 million, had moved from wallets linked to the Oct. 29 hack since Thursday afternoon. Most of those funds were swapped into bitcoin done the cross-chain speech protocol THORChain, leaving astir 192 cardinal XRP worthy $226 cardinal successful the hackers’ possession.

The latest transactions pushed the magnitude of stolen cryptocurrency converted into bitcoin to astir 1,650 BTC, valued astatine $124 cardinal arsenic of Friday morning. That full astir doubled implicit the preceding day, with XRP accounting for overmuch of the increase.

Despite the accelerating activity, Elliptic estimated that $3.11 cardinal remains successful addresses associated with the theft, chiefly successful bitcoin and ether. The archetypal 18,270 BTC stolen from Binance, valued astatine astir $1.4 cardinal astatine the time, has not moved since being distributed crossed 19 wallets soon aft the attack.

The largest ether holdings besides stay untouched. Elliptic estimated that lone astir $3 cardinal of the astir $1.33 cardinal successful stolen ETH had been moved done laundering channels, portion the 9 largest ETH wallets person remained inactive since Oct. 30.

The findings people a caller signifier successful the hackers’ efforts to conceal the stolen assets. As Bitcoin.com News previously reported, the attackers transferred each 233.46 cardinal stolen XRP into six caller wallets connected Nov. 2 aft the funds had remained dormant for astir 80 hours. Two of those wallets began distributing XRP to dozens of further addresses Thursday, with overmuch of the cryptocurrency subsequently exchanged for bitcoin.

Solana assets person besides been a absorption of the laundering operation. Elliptic recovered that fundamentally each of the stolen SOL, worthy astir $87 cardinal astatine existent prices, has present been swapped, transferred betwixt blockchains, oregon mixed done privateness services. Much of the converted worth yet reached bitcoin wallets.

The researchers besides identified astir $2.5 cardinal successful bitcoin processed done Wasabi-style coinjoin transactions, which harvester coins from aggregate users to complicate blockchain tracking. Another $1.1 cardinal successful stolen ETH and SOL entered the Privacy Cash protocol opening Nov. 3, prompting the work to temporarily suspend deposits portion strengthening its screening procedures.

The laundering web has expanded dramatically since the breach. Elliptic has present identified much than 20,000 wallets crossed 16 blockchains, involving astatine slightest 36 services and 65,000 transactions. Bitcoin.com News reported Monday that the cognition had progressive astir 12,000 wallets and 40,000 transactions astatine that stage.

One Week After the Binance Hack

Of the archetypal $6.43 cardinal stolen, astir $2.85 cardinal has been frozen oregon seized, mostly done involution by stablecoin issuers. Elliptic believes lone a negligible magnitude has really been converted into spendable funds. Moving assets betwixt wallets oregon exchanging 1 cryptocurrency for different does not needfully mean the proceeds person been successfully cashed out.

The FBI has attributed the attack to North Korea’s TraderTraitor hacking operation, though Pyongyang has denied responsibility.

Binance disclosed Tuesday that the breach followed a months-long run involving malicious developer software, fraudulent occupation interviews, and compromised interior artificial quality tools. The attackers yet gained entree to wallet-signing infrastructure and executed unauthorized transactions crossed galore blockchains.

Elliptic expects the remaining ether holdings to beryllium gradually converted into bitcoin, followed by attempts to speech the cryptocurrency for accepted wealth done over-the-counter brokers and trading platforms.

The steadfast drew comparisons to the February 2025 Bybit hack—the erstwhile grounds precocious crypto heist with astir $1.5 cardinal swiped—when North Korean attackers converted astir 499,000 stolen ETH wrong 10 days, portion the process of cashing retired extended implicit respective months.

For now, the bulk of the Binance proceeds remains traceable, giving exchanges and investigators further opportunities to place and perchance intercept the funds earlier they tin beryllium converted into usable cash.