Hackers responsible for the recent Binance theft have initiated the conversion of approximately 42 million XRP, valued at $50 million, primarily into bitcoin via the THORChain protocol. According to Elliptic, this activity follows a period of inactivity for the stolen assets, which were moved to new addresses between November 2 and November 5.
The total volume of bitcoin derived from the stolen assets has reached approximately 1,650 BTC, with a valuation of $124 million. Currently, about 192 million XRP, worth roughly $226 million, remains unswapped in wallets associated with the breach. The FBI has linked the attack, which involved the unauthorized transfer of 233.46 million XRP on October 29, to the North Korean group TraderTraitor.
Binance reported that the total value of the theft reached $6.34 billion, with the exchange having frozen or intercepted $2.85 billion to date. Elliptic estimates that $3.11 billion in stolen funds remains in linked addresses, primarily held in ether and bitcoin. The laundering operation has utilized over 20,000 wallets across 16 blockchains and involved at least 65,000 transactions.
The attackers have prioritized converting assets like XRP and SOL into bitcoin to avoid the freeze mechanisms available for stablecoins. Elliptic noted that approximately $87 million in SOL has already been processed, alongside significant portions of TRX holdings. Small amounts of converted bitcoin, totaling $2.5 million, have been moved through coinjoin services since November 1.
