Analytics firm Elliptic says the XRP hoard linked to the October Binance breach fell to roughly 60 million tokens by Nov 10 after large swaps to Bitcoin.
Blockchain analytics company Elliptic reported that the XRP pool linked to the October 29 Binance hack has been dramatically reduced, standing at roughly 60 million tokens as of the morning of Nov 10. The decline follows a series of large‑scale conversions, primarily into Bitcoin, executed through the decentralized swapping protocol THORChain.
Elliptic’s tracking shows the stolen stash originally contained 233.5 million XRP across five Binance‑controlled wallets. By Nov 6 the balance was about 192 million, dropping to 148 million on Nov 7, then 95 million on Nov 9, and finally to the current estimate of 60 million. The firm notes that the remaining tokens include roughly 33 million held in an address that has not moved since its funding on Nov 2.
The majority of the recent conversions were processed on THORChain, which on the night of Nov 9‑10 swapped approximately 35 million XRP, almost entirely for Bitcoin. THORChain’s own logs show that XRP trading was halted on Nov 7, resumed briefly on Nov 8, and faced another pause on the morning of Nov 10, during which new deposits were refunded. The protocol’s streaming‑swap mechanism splits large orders into smaller chunks, a design that can mitigate slippage but also allows arbitrageurs to rebalance pools between chunks.
Elliptic cautions that the shrinking XRP balance does not necessarily indicate cash‑out activity; much of the movement appears to be a conversion from XRP to Bitcoin, leaving proceeds on‑chain rather than in fiat. The firm estimates that only a negligible portion of the funds has likely been withdrawn from the broader laundering network, with most activity remaining visible on public blockchains.
Observers will monitor whether THORChain resumes full XRP trading and if additional Bitcoin payouts emerge from the converted stash. Further analysis will be needed to determine if the remaining XRP will be liquidated, held, or moved to other platforms.
Discussion 0