The attacker behind Binance’s $6.43 billion cryptocurrency theft has begun converting stolen XRP into Bitcoin, moving approximately $50 million worth of the token through cross-chain infrastructure, primarily THORChain, according to blockchain analytics firm Elliptic.
Elliptic’s November 6 investigation update found that approximately 42 million XRP had been transferred from addresses linked to the October 29 theft and swapped, mostly into Bitcoin. Around 192 million XRP, worth approximately $226 million, remained in the attacker’s wallets at 08:45 UTC.
The latest activity adds another asset to an expanding laundering operation involving multiple blockchains, decentralized exchanges, lending protocols and cross-chain services. Binance’s original security breach involved unauthorized withdrawals from its hot wallets across 11 blockchain networks.
How Much of the Stolen XRP Has Been Converted?
Five Binance wallets initially transferred approximately 233 million XRP to an attacker-controlled address during the October 29 incident. The funds subsequently remained largely untouched until November 2, when the entire balance was distributed across six newly created addresses.
The laundering process accelerated on November 5. Two of those six addresses began distributing XRP to dozens of additional wallets, which then exchanged the tokens for other cryptocurrencies, primarily through THORChain.
By the morning of November 6, approximately 42 million XRP had left the original holdings, representing roughly $50 million at the time of Elliptic’s assessment. The remaining 192 million XRP was still distributed across addresses associated with the theft.
The distinction between the original stolen balance and the amount already converted matters. The attacker has not liquidated the entire XRP position, and the remaining tokens continue to represent a substantial portion of the unrecovered assets.
Investor Takeaway
Approximately $50 million in XRP has entered the laundering process, while another $226 million remains exposed to potential movement across blockchain networks.
Why Is the Attacker Converting Stolen Assets Into Bitcoin?
The conversion strategy reduces reliance on tokens whose issuers can freeze balances. Stablecoins such as USDT and USDC have centralized issuers capable of blacklisting addresses, allowing them to prevent certain stolen funds from being transferred.
Bitcoin and native XRP, by contrast, do not have a central issuer capable of freezing individual wallet balances. Moving stolen tokens into Bitcoin therefore removes one potential intervention point, although the resulting transactions remain publicly traceable.
Elliptic estimated that approximately 1,650 BTC, worth $124 million, had accumulated in newly created Bitcoin addresses by 08:45 UTC on November 6. This represents the cumulative conversion of several stolen assets, including Solana, Tron-based tokens, Ethereum and XRP. Most of the latest increase came from XRP routed through THORChain.
The Bitcoin figure nearly doubled from the previous day’s estimate. Earlier movements included converting stolen Solana into USDC, bridging the funds to Ethereum and subsequently swapping them into Bitcoin. The attacker’s earlier use of THORChain to convert stolen Solana established another route for moving assets between blockchain networks.
Elliptic also identified approximately 33 BTC, worth $2.5 million, passing through Wasabi-style coinjoins since November 1. These transactions combine funds from multiple participants, making it harder to establish direct links between individual deposits and withdrawals.
How Much of the Binance Hack Remains Unrecovered?
Elliptic’s November 6 assessment put the total amount frozen or seized at approximately $2.85 billion, while around $3.11 billion remained in addresses linked to the theft.
The directly stolen 18,270 BTC has not moved since the initial attack. Most of the stolen Ethereum also remains untouched, with only approximately $3 million of the $1.33 billion ETH position having moved, according to Elliptic.
The investigation has identified more than 20,000 wallets across 16 blockchains, at least 36 services and approximately 65,000 transactions associated with the laundering operation. The activity is highly automated, with funds repeatedly distributed, swapped and transferred through newly created addresses.
However, converting cryptocurrency into Bitcoin does not establish that the attacker has successfully cashed out. Elliptic said a negligible amount of the stolen funds had likely reached the point of conversion into spendable money. The majority remains on public blockchains, where investigators can continue tracking transfers.
Investor Takeaway
The conversion into Bitcoin makes issuer-led freezes more difficult, but the funds remain traceable until they reach exchanges, OTC brokers or other cash-out channels.
What Should Investigators Watch Next?
The remaining XRP balance is one of the clearest indicators of the next stage of the laundering operation. Further transfers through THORChain and other cross-chain services could move additional funds into Bitcoin, while smaller batches may pass through mixing services and newly created wallets.
Elliptic expects the attacker to continue converting the largely untouched Ethereum holdings into Bitcoin before attempting to cash out through over-the-counter brokers and exchanges. The firm’s analysis of the 2025 Bybit theft provides a precedent: the stolen assets were converted over a relatively short period, but cashing them out took months.
The earlier movement of approximately $242 million through Tron-based swaps and bridges also showed how quickly stolen funds can spread across services. That earlier investigation into the Binance attacker’s Tron laundering routes documented the use of THORChain, Relay, Chainflip and Symbiosis.
For now, the distinction remains between laundering and liquidation. The attacker has converted a growing share of the stolen assets into Bitcoin, but the available blockchain evidence does not establish that the funds have reached cash-out channels or become inaccessible to investigators.
