Binance Hacker XRP Stockpile Crashes via Bitcoin Swaps

Elliptic Tracks Shrinking Stolen Stockpile

Blockchain intelligence firm Elliptic reported that the XRP stockpile linked to the October Binance breach dropped to 60 million tokens by November 10. Bitquery ledgers traced 233.5 million XRP leaving five Binance accounts during the October 29 exploit. Remaining balances recorded by Elliptic steadily declined from 192 million XRP on November 6 down to 148 million the following day and 95 million by November 9. Elliptic noted that roughly 33 million tokens remained inside a single address untouched since November 2. The drop occurred while broader XRP spot prices declined 24% over the preceding 30 days.

Federal Bureau of Investigation dockets attribute the underlying exchange breach directly to North Korea-linked state-sponsored cyber actors. On-chain analysis confirmed the laundering methodology mirrors previous multi-million dollar token conversion tactics observed during historical exchange exploits. Operators routinely split large illicit balances across cross-chain routing venues to evade automated compliance monitoring systems deployed by centralized exchanges.

THORChain Swaps Drive Bitcoin Conversions

Elliptic observed approximately 35 million additional XRP swapped through THORChain overnight into Bitcoin. Protocol records detailed repeated interruptions, including a trading halt on November 7 that paused swaps for nearly a day. THORChain resumed normal routing by the afternoon of November 8. Swaps halted again on the morning of November 10, triggering automated deposit refunds. Protocol documentation shows trading halts block new swaps while permitting refunds, whereas signing halts queue outbound payments. Streaming mechanisms split orders into smaller increments to lower slippage costs for arbitrageurs.

Cross-chain liquidity pools provide an alternative exit route for compromised funds when centralized venues enforce strict know-your-customer controls. Protocol tracking separates successful payouts from refunded portions, preventing basic deposits from being miscounted as completed sales. Transaction ledgers show that perpetrators accept execution delays in exchange for reduced transaction traceability across public block heights.

On-Chain Ledgers Clarify Execution States

Bitint reconstructed deposit populations through November 9, putting total converted volume at no more than 93.85 million XRP after accounting for refunds. Elliptic stated that a negligible amount had left public blockchains entirely as cash. Swapping XRP for Bitcoin reduces asset exposure while keeping capital within decentralized networks.

Chainalysis assisted custody providers in tracking and recovering funds following related security incidents involving tens of millions of dollars. Public blockchain transaction records confirm that tracing assets requires reconstructing complex fund movements across multiple deposit addresses. Investigators rely heavily on centralized service intervention powers to halt suspicious fund transfers before perpetrators successfully cash out.