Binance Hacker's XRP Stockpile Plummets Following Bitcoin Swaps

The reserve of tokens associated with an October security breach at Binance experienced a sharp decrease, dropping to approximately 60 million units by November 10. According to analytics provided by Elliptic, this reduction followed a fresh wave of asset conversions that predominantly moved funds into Bitcoin. Investigators noted that about 35 million extra tokens were processed overnight via THORChain during this period.

Data gathered by Bitquery indicated that the initial breach on October 29 involved 233.5 million tokens transferred away from five Binance accounts. Subsequent tracking by Elliptic revealed a steady decline in the remaining balance, dropping to roughly 192 million on November 6, about 148 million by November 7, and near 95 million early on November 9. The November 10 estimate captured the remaining 60 million, a figure that included nearly 33 million sitting in a single address untouched since November 2.

Stolen Binance tokens dwindled to 60 million as funds were rapidly converted into Bitcoin.

Tracking Binance XRP News and Conversions

The laundering operations encountered multiple interruptions during the conversion process. Analytics revealed that THORChain temporarily paused trading operations on November 7, halting swaps for almost an entire day before resuming activity on the afternoon of November 8. By the morning of November 10, trading appeared suspended once more, resulting in automatic refunds for incoming deposits.

Different network mechanics explain how these transactions were handled. Protocols like THORChain split orders into smaller segments to minimize price slippage, while mechanisms exist to distinguish between successful payouts and returned portions. Observers noted that counting deposit segments alongside final payouts separately would falsely inflate total activity metrics.

Elliptic noted that a negligible fraction of the overall operation was actually cashed out into traditional currency, with the majority of illicit activity simply rotating assets into alternative crypto holdings rather than leaving public blockchains entirely.

Why it matters

The rapid reduction of the stolen token reserve through cross-chain swaps highlights ongoing vulnerabilities and the mechanics utilized by threat actors to obfuscate stolen digital assets. Understanding these conversion pathways provides vital context for monitoring illicit cryptocurrency movements across decentralized liquidity networks.

For digital asset participants and market observers, tracking these inventory levels and liquidity halts clarifies how quickly hacked funds can be shifted into alternative networks, even amid broader market volatility and protocol interruptions.