Hackers behind the $6.4 billion Binance theft have begun moving stolen XRP and converting more cryptocurrency into bitcoin, although approximately $3.1 billion in assets remains largely untouched more than a week after the attack, according to the latest findings from blockchain analytics firm Elliptic.

In an analysis updated Friday, Elliptic revealed that about 42 million XRP, worth $50 million, had moved from wallets linked to the Oct. 29 hack since Thursday afternoon. Most of those funds were swapped into bitcoin through the cross-chain exchange protocol THORChain, leaving approximately 192 million XRP worth $226 million in the hackers’ possession.

The latest transactions pushed the amount of stolen cryptocurrency converted into bitcoin to approximately 1,650 BTC, valued at $124 million as of Friday morning. That total nearly doubled over the preceding day, with XRP accounting for much of the increase.

Despite the accelerating activity, Elliptic estimated that $3.11 billion remains in addresses associated with the theft, primarily in bitcoin and ether. The original 18,270 BTC stolen from Binance, valued at approximately $1.4 billion at the time, has not moved since being distributed across 19 wallets shortly after the attack.

The largest ether holdings also remain untouched. Elliptic estimated that only about $3 million of the roughly $1.33 billion in stolen ETH had been moved through laundering channels, while the nine largest ETH wallets have remained inactive since Oct. 30.

The findings mark a new phase in the hackers’ efforts to conceal the stolen assets. As Bitcoin.com News previously reported, the attackers transferred all 233.46 million stolen XRP into six new wallets on Nov. 2 after the funds had remained dormant for roughly 80 hours. Two of those wallets began distributing XRP to dozens of additional addresses Thursday, with much of the cryptocurrency subsequently exchanged for bitcoin.

Solana assets have also been a focus of the laundering operation. Elliptic found that essentially all of the stolen SOL, worth approximately $87 million at current prices, has now been swapped, transferred between blockchains, or mixed through privacy services. Much of the converted value ultimately reached bitcoin wallets.

The researchers also identified approximately $2.5 million in bitcoin processed through Wasabi-style coinjoin transactions, which combine coins from multiple users to complicate blockchain tracking. Another $1.1 million in stolen ETH and SOL entered the Privacy Cash protocol beginning Nov. 3, prompting the service to temporarily suspend deposits while strengthening its screening procedures.

The laundering network has expanded dramatically since the breach. Elliptic has now identified more than 20,000 wallets across 16 blockchains, involving at least 36 services and 65,000 transactions. Bitcoin.com News reported Monday that the operation had involved approximately 12,000 wallets and 40,000 transactions at that stage.

Of the original $6.43 billion stolen, approximately $2.85 billion has been frozen or seized, largely through intervention by stablecoin issuers. Elliptic believes only a negligible amount has actually been converted into spendable funds. Moving assets between wallets or exchanging one cryptocurrency for another does not necessarily mean the proceeds have been successfully cashed out.

The FBI has attributed the attack to North Korea’s TraderTraitor hacking operation, although Pyongyang has denied responsibility.

Binance disclosed Tuesday that the breach followed a months-long campaign involving malicious developer software, fraudulent job interviews, and compromised internal artificial intelligence tools. The attackers ultimately gained access to wallet-signing infrastructure and executed unauthorized transactions across numerous blockchains.

Elliptic expects the remaining ether holdings to be gradually converted into bitcoin, followed by attempts to exchange the cryptocurrency for conventional money through over-the-counter brokers and trading platforms.

The firm drew comparisons to the February 2025 Bybit hack—the previous record high crypto heist with about $1.5 billion swiped—when North Korean attackers converted approximately 499,000 stolen ETH within 10 days, while the process of cashing out extended over several months.

For now, the majority of the Binance proceeds remains traceable, giving exchanges and investigators additional opportunities to identify and potentially intercept the funds before they can be converted into usable cash.

免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。