Stolen XRP Is Melting Into Bitcoin as Hackers Swap $50M via THORChain

The stolen XRP is on the move — and it's turning into bitcoin. Attackers swapped roughly $50 million of it, mostly through THORChain, according to blockchain analytics firm Elliptic. The bitcoin they've pulled out of other stolen assets now adds up to about 1,650 BTC, a pile Elliptic values at $124 million — nearly double the figure from a day earlier.

The main ETH and BTC holdings haven't budged, Elliptic said in its Friday update, and roughly $226 million in XRP was still sitting still as of 3:45 a.m. ET on Nov. 6. That untouched bitcoin is separate from the 18,270 BTC grabbed directly in the theft, which has stayed put since it was split across 19 addresses.

The XRP shuffle kicked off Nov. 5. Stolen XRP had been spread to six addresses on Nov. 2 and left there, per Elliptic. Two of those addresses then fanned funds out to dozens of fresh accounts, which handled the swapping — most of it through THORChain — into bitcoin.

Nor is XRP the only stolen token on that path. Batches of stolen SOL were sold for USDC, bridged to Ethereum, swapped for ETH and then converted into bitcoin. THORChain's reopening restored the route: the protocol said swaps had resumed on several chains, including Bitcoin, Ethereum and the XRP Ledger, after a software update. By the evening of Nov. 4, about 12,200 ETH — worth $29 million and mostly from sales of stolen SOL — had passed through THORChain into bitcoin.

The FBI blamed the Oct. 29 theft on North Korea's TraderTraitor activity. In an Oct. 31 notice, it urged THORChain node operators, instant exchanges and other crypto services to block transactions involving the listed addresses or any funds derived from them.

Frozen or seized assets still stand at $2.85 billion, the same total Elliptic cited on Nov. 2, while about $3.11 billion remains in theft-linked addresses — mostly ETH and BTC, native assets no token issuer can freeze. Swapping isn't the same as cashing out, though. Elliptic estimates only a negligible slice has likely reached that stage, and it flags stablecoins briefly held in transit and centralized services used to cash out as the best remaining chances to intercept the proceeds.