Binance theft trail expands as investigators track XRP swaps into bitcoin

Investigators tracing the October 29 Binance theft have identified another wave of XRP conversions into bitcoin, extending a laundering trail that already spans thousands of wallets. Around $50 million in XRP had moved by Elliptic’s November 6 update, most of it exchanged through THORChain.

The activity increased the amount converted from other stolen assets into bitcoin to approximately 1,650 BTC, valued at $124 million at that observation time. That movement is significant, but it is a different milestone from successfully withdrawing proceeds into conventional money.

XRP begins moving while larger balances sit idle

The XRP transfers followed an earlier redistribution of the stolen tokens into six wallets on November 2. By November 6, roughly 192 million XRP, then worth about $226 million, remained with the attackers. The newly active wallets added another route to an investigation already covering multiple chains.

Much larger holdings had barely moved. The original 18,270 BTC taken from Binance remained distributed across 19 wallets, while the largest ether addresses were also largely inactive. Elliptic estimated that $3.11 billion remained in theft-linked addresses, predominantly as bitcoin and ether.

These are dated investigative estimates. Token prices, address classifications and subsequent transactions can alter the dollar totals, so the balances should not be read as a live inventory or a final loss calculation.

A sprawling trail still leaves interception points

Elliptic’s November 6 account described more than 65,000 transactions involving over 20,000 wallets, 16 blockchains and at least 36 services. Some funds had passed through several chains within hours. The company also identified smaller amounts moving through privacy services.

Despite that complexity, Elliptic assessed the amount successfully cashed out as likely negligible. Converting one cryptocurrency into another changes the form of the proceeds; it does not establish that the holder has reached a bank account or another usable exit.

That distinction explains why investigators continue to focus on exchanges, brokers and other counterparties. Tracing can identify where assets move, while interception depends on the controls available at the next service and the cooperation of its operators.

Federal attribution sharpens the response

The FBI attributed the theft to North Korean TraderTraitor actors on October 31. Together with the US Secret Service and IRS Criminal Investigation, it urged cryptocurrency services to block transactions associated with the published addresses, including transfers derived from them.

The bureau specifically called for cooperation from instant exchanges, decentralized finance services, blockchain analytics providers and THORNode operators. That request places the latest XRP swaps within an active international containment effort. The immediate test is whether movement across networks can be interrupted before the remaining assets reach an effective cash-out route.