Binance hacker’s XRP stockpile rapidly crashes driven by Bitcoin swaps

The shrinking reserve and its swap route

Bitquery’s theft trace identified 233.5 million $XRP sent from five Binance accounts during the Oct. 29 attack.

Elliptic put the remaining balance at about 192 million $XRP on Nov. 6, about 148 million in its Nov. 7 account, and about 95 million by early afternoon Nov. 9. Its Nov. 10 estimate was about 60 million, including roughly 33 million in an address that had remained unmoved since its Nov. 2 funding.

Chart by CryptoSlate

Source: Elliptic update, November 10, 2026, 11:00 UTC

View dataHide data

Elliptic also described repeated interruptions, saying that THORChain halted $XRP trading on Nov. 7, with swaps stopping for almost a day, and reported successful swaps again from Nov. 8 afternoon. On the morning of Nov. 10, it said $XRP swaps appeared halted again, with new deposits refunded.

THORChain’s documentation says a trading halt stops swaps while allowing refunds, a signing halt queues outbound payments, and a full chain halt stops observation of that chain. A pending payment, a returned $XRP deposit, and a completed Bitcoin conversion represent different outcomes.

Bitint’s Nov. 9 reconstruction put $XRP actually converted at no more than 93.85 million for its defined deposit population after refund corrections. Its Bitcoin settlement ledger cut off at Nov. 7, and was rechecked through Nov. 8.

Liquidity sets the pace

THORChain’s streaming-swap mechanism breaks an order into smaller parts that can reduce slippage, the price cost of executing against available liquidity. When parts are spaced apart, arbitrageurs can rebalance the pools between them.

The protocol also tracks successful and unsuccessful amounts separately. A stream can pay out the converted value and return the unsuccessful $XRP portion, while a failed first attempt can trigger a full refund.

Counting the deposit, its smaller executions, and its payout as separate sales would overstate activity.

The next useful observations are fresh balances in the remaining addresses, matched successful $XRP conversions and Bitcoin payouts, and the route’s actual refund or halt state.

Smaller inventory limits what remains on this tracked leg, and usable liquidity and access govern how quickly it can be converted.

In its Nov. 10 update, Elliptic estimated that a negligible amount had likely been cashed out across the wider laundering operation: much of the activity had changed the asset held while leaving funds on public blockchains.

Selling $XRP for Bitcoin reduces that $XRP exposure even while the proceeds remain in crypto.