Blockchain analytics firm Elliptic has confirmed that hackers responsible for the Binance theft have converted approximately 42 million XRP — valued at roughly $50 million — primarily into Bitcoin, using the decentralized cross-chain liquidity protocol THORChain to execute the swaps. The latest movement brings the total amount of Bitcoin converted from the Binance hack proceeds to approximately 1,650 BTC, a figure that illustrates both the scale of the original breach and the sophistication of the laundering operation now underway.
The choice of THORChain as a conversion vehicle is not incidental. The protocol allows users to swap assets across entirely separate blockchain networks — in this case, moving value from the XRP Ledger to the Bitcoin network — without relying on a centralized exchange that would impose identity verification or flag suspicious activity. For threat actors holding large quantities of stolen altcoins, THORChain and similar cross-chain bridges represent an attractive exit ramp precisely because they were designed to be permissionless and censorship-resistant. That same openness, celebrated in decentralized finance circles, becomes a liability when exploited for large-scale asset laundering.
The preference for Bitcoin as the destination asset is a pattern Elliptic and other blockchain intelligence firms have documented repeatedly in post-hack laundering scenarios. Bitcoin's unmatched liquidity depth means that even a position of 1,650 BTC can be gradually distributed across mixers, peer-to-peer platforms, and over-the-counter desks without causing the kind of price slippage that would occur in thinner markets. XRP, while liquid by most standards, is far more traceable within its own ecosystem and more susceptible to coordinated freezes if centralized actors — including Ripple itself — intervene. Converting to Bitcoin effectively shifts the problem onto a network where no issuer has freeze authority and where coin-join and mixing techniques are more mature.
The 42 million XRP figure also raises questions about how that specific tranche of stolen assets was held and managed in the period between the initial breach and this latest conversion event. Large stolen positions are rarely moved all at once; sophisticated threat actors typically stage asset movements to avoid triggering automated compliance alerts on the platforms they use for final off-ramp. The fact that Elliptic is publishing these findings in near real-time suggests the firm's tracing infrastructure is tracking wallet clusters associated with the hack with a high degree of confidence — but it also means the hackers are aware that their movements are being watched, which may accelerate their laundering timeline.
THORChain's role in this incident will inevitably intensify the regulatory scrutiny the protocol already faces. Cross-chain bridges and native swap protocols occupy a genuinely ambiguous space in existing legal frameworks. They are not exchanges in the traditional sense, have no customer accounts, and in most jurisdictions have never been required to register with financial regulators. That architecture, purpose-built for resilience and decentralization, makes it extraordinarily difficult for law enforcement to compel transaction reversal or asset freezes. Regulators in the United States and European Union have been circling this problem for years, but no comprehensive framework for decentralized cross-chain protocols has yet been enacted.
For the broader crypto industry, the Binance hack laundering operation is a case study in the arms race between blockchain forensics and criminal tradecraft. Elliptic's visibility into these movements is genuinely impressive — tracking 42 million XRP as it fragments, crosses chain boundaries, and re-aggregates as Bitcoin requires sophisticated heuristics and significant on-chain data infrastructure. But visibility is not interdiction. Knowing where stolen funds are moving and being able to stop them are two very different capabilities, and the gap between them remains wide so long as permissionless protocols provide frictionless cross-chain conversion.
The 1,650 BTC now attributed to Binance hack proceeds represents a moving target. That position will almost certainly be further fragmented in the coming days and weeks, routed through additional intermediary wallets, and potentially passed through mixing services before any attempt at fiat conversion. Exchanges and over-the-counter desks that have been alerted to the associated wallet clusters will be watching — but the hackers have demonstrated they understand how to navigate around centralized chokepoints. What this episode ultimately underscores is that cross-chain infrastructure is now a primary tool in the post-hack playbook, and that the industry's response frameworks — both technical and regulatory — have not kept pace with that reality.
Written by the editorial team — independent journalism powered by Bitcoin News.