Hackers behind the Binance theft have started converting stolen XRP into bitcoin, mostly through THORChain, according to blockchain analytics firm Elliptic. About $50 million is swapped, while roughly $226 million remains unswapped.
Hackers tied to the record Binance theft have begun converting stolen XRP into bitcoin. Elliptic said about 42 million XRP, roughly $50 million, was already swapped, mostly through THORChain. About 192 million XRP, roughly $226 million, remained unswapped in addresses linked to the theft.
How the XRP started moving
The XRP sat quiet at first. Early on Nov. 2, between 02:12 and 04:00 UTC, all about 233 million XRP moved into six new addresses, where it stayed until Nov. 5, Elliptic said. From the afternoon of Nov. 5, two of those addresses began sending XRP to dozens of new accounts that swapped it, mostly through THORChain into bitcoin.
As a result, converted bitcoin from other stolen assets nearly doubled overnight to about 1,650 BTC, worth some $124 million. Most of that jump came from the XRP route.
Why the attacker is moving into bitcoin
Issuers can freeze many stablecoins, but they cannot freeze XRP the same way, and they cannot freeze bitcoin. Tether and Circle locked down large stablecoin tranches on Oct. 29, and the attacker then prioritized assets outside that kill switch, Bitcoin Magazine reported.
The main bitcoin and ether holdings from the theft have still not moved, Elliptic said. About $3.11 billion remains in addresses linked to the Binance theft, mostly as ether and bitcoin, according to Decrypt's report on the Elliptic update.
Elliptic said the speed points to conventional automation, not an AI agent making live decisions. Bitcoin Magazine says the test now is whether THORChain operators and other bridges keep blocking the published attacker addresses fast enough to slow the XRP-to-bitcoin pipe.
Sources: Bitcoin Magazine, Decrypt
Trading involves risk.
Risk Disclaimer
