Binance hackers convert stolen XRP to bitcoin through THORChain as the FBI names North Korea's TraderTraitor unit

The people who stole from Binance have swapped about 42 million XRP, worth roughly $50 million, mostly into bitcoin through the cross-chain swap protocol THORChain, Elliptic said, according to Bitcoin Magazine. Chainalysis reported that funds also moved onto Solana after the thieves emptied $500 million from staging wallets on Tron. It added that Binance proceeds mixed on-chain with funds from last month's theft at Bitget, which investigators attributed to North Korea.

The FBI has blamed North Korea's TraderTraitor unit for the theft, which it put at $6.3 billion. Chainalysis estimates about $6.4 billion. North Korea denies any role, and its state media called the accusation a "grave political provocation." Binance said it set aside more than $6.34 billion of company funds to cover customers. Reports on how much it has already replaced differ: NBC says 90%, and co-CEO Richard Teng told CNBC 98%. Rekt News has added the incident to its loss tracker.

The attack exploited people and internal tooling. It did not rely on any flaw in a smart contract. StepSecurity's review of Binance's report says preparation began in June, when a developer-operations engineer on the Binance Wallet team downloaded a tampered Homebrew installer while searching for an artificial intelligence (AI) coding tool. Teng told CNBC that in September the attackers posed as recruiters and handed out a coding exercise that contained hidden malware. From there they moved through internal AI tools until they reached the system that authorizes wallet transactions. Binance describes the root cause as unauthorized access to an internal signing service, which then sent transactions outside the normal withdrawal process. StepSecurity notes that the report names no zero-day vulnerability and no specific AI product, and that it does not explain how the attackers moved from one machine to the next.

Customers reacted by withdrawing funds. Santiment's November 6 report found heavy withdrawals from Binance and some of bitcoin's most negative social sentiment in its records. Futures traders, by contrast, kept billions of dollars in open positions on the exchange.