Binance Hackers Swap $50M of Stolen XRP for Bitcoin, Elliptic Says

The money keeps moving. Wallets tied to the Binance theft have swapped roughly $50 million of stolen XRP into bitcoin, mostly routing through THORChain, according to an Elliptic update covering activity through Friday 6 November. About $226 million of XRP is still sitting in addresses linked to the theft. Elliptic is publishing the whole analysis under the title 'How North Korea is laundering the $6.4 billion stolen from Binance.'

The running tally shows how much has already been scrubbed. All of the stolen SOL, about $87 million at current prices, has been swapped, bridged or mixed, and much of it now sits inside roughly 1,650 BTC worth about $124 million that was converted out of other stolen assets. Behind those balances is a mountain of small moves: more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions. About $3.11 billion remains in linked addresses, mostly ether and bitcoin, while $2.85 billion has been frozen or seized. The drain is dated 29 October, though the size is still stated two ways — Binance says $6.34 billion, Elliptic's page says $6.43 billion. Both agree on the date and the 11 blockchains involved.

Gopax had a rough Friday of its own. The South Korean exchange halted standard withdrawals at 2:55 p.m. and trading at 3:53 p.m. after receiving an email from a party claiming it could hack the venue, according to the exchange. Gopax said it is shifting all held assets to cold wallets and that no loss has been reported so far, with an official noting the threat itself has not been verified. Direct withdrawals through the website or app are temporarily unavailable, and customers have been told to apply through the customer support centre. One caveat: the exchange's own notice page would not render readable text when checked, so those timings rest on its remarks to Korean media rather than a notice anyone could read.

Gopax isn't alone. Brazil's Mercado Bitcoin froze deposits and withdrawals earlier in the week after a security incident, with preliminary estimates of suspicious transfers near $40 million. The company said it blocked $11 million with help from Tether, Circle, Paxos, BRL1 and Chainalysis. Deposits and withdrawals remain suspended with no restart date.

Over on the XRP Ledger, the fixCleanup3_4_0 amendment activated on 4 November at 14:52 UTC, at ledger 108,112,129, closing a permission flaw that could let an account authorised to burn issued tokens mint new ones under certain conditions. Scope matters: the flaw hit issued assets such as stablecoins and Multi-Purpose Tokens, not XRP's native supply, so holding XRP means the amendment changes nothing about the asset itself. Getting it live took two attempts — validator support briefly fell below the required threshold on 21 October, restarting the mandatory 14-day approval window, and the second attempt ran 14 days and five minutes. No publicly confirmed exploitation has been reported, and disclosures don't name any issuer that suffered unauthorised token creation. The amendment does not switch on the ledger's planned lending system, which needs separate validator approval and remains open for voting.

In Washington, the US Department of Labor's final rule on alternative assets in 401(k) plans reached the White House for review, logged on 5 November as RIN 1210-AC38, titled 'Fiduciary Duties In Selecting Designated Investment Alternatives.' The docket lists the Employee Benefits Security Administration as authoring office, marks the stage as final rule, flags it as economically significant and notes there is no legal deadline for completion. That review is a procedural step that usually comes before a rule is released publicly — it is not a rule in force, and nothing commits to a publication date. The March 30 proposal would give plan fiduciaries a legal safe harbour under ERISA when they follow a documented process to select designated investment alternatives, with six non-exhaustive factors to weigh, and carried a 60-day comment window. The department's fact sheet says the proposal carries out Executive Order 14330. Separately, the BLS Employment Situation put October nonfarm payrolls at a gain of 165,000, well above the 48,000 average monthly gain over the prior 12 months, with unemployment little changed at 4.1% and average hourly earnings up 14 cents, or 0.4%, to $38.00, and 3.1% higher over the year.