The XRP stockpile linked to Binance's October hack had declined to about 60 million tokens by November 10, according to blockchain analytics firm Elliptic, following a series of conversions predominantly into Bitcoin.
Blockchain analysis firm Bitquery initially identified 233.5 million XRP sent from five Binance accounts during the October 29 attack. Elliptic tracked the remaining balance at approximately 192 million XRP on November 6, declining to 148 million on November 7, 95 million by early afternoon November 9, and reaching about 60 million by November 10.
Conversion Activity and Route Disruptions
Elliptic reported approximately 35 million XRP swapped through THORChain overnight before its November 10 update, with nearly all conversions directed into Bitcoin. The conversion activity occurred during periods when THORChain experienced trading interruptions, including a halt on November 7 that lasted almost a day, followed by resumed activity from November 8 afternoon.
Bitint's November 9 analysis estimated that actual XRP conversions totaled no more than 93.85 million after accounting for refunds, with Bitcoin settlement data tracked through November 8.
Market Context and Liquidity Factors
The XRP conversions coincided with broader weakness in the token, which declined 24 percent over the 30 days preceding the analysis. The mechanics of THORChain's streaming-swap mechanism break larger orders into smaller portions to reduce slippage, allowing arbitrageurs to rebalance pools between executions.
Elliptic estimated in its November 10 update that a negligible amount from the stolen funds had been cashed out across the wider laundering operation, with most activity involving the conversion of assets while leaving funds on public blockchains.
