Binance Hacker's XRP Stockpile Plunges as Stolen Tokens Are Swapped Into Bitcoin

The XRP stockpile tied to Binance's Oct. 29 hack had fallen to roughly 60 million tokens by Nov. 10, blockchain analytics firm Elliptic reported, following another wave of conversions directed largely into Bitcoin.

In an update published Nov. 10, Elliptic said approximately 35 million additional XRP had been swapped through THORChain — a decentralized cross-chain liquidity protocol that settles trades between blockchains from pooled funds rather than a centralized order book — with almost all of it exchanged for Bitcoin. The reduction occurred while XRP was under broader market pressure, down 24% over the previous 30 days — though the laundering data do not establish whether that price decline resulted from the attacker's conversions.

The Shrinking Reserve and Its Swap Route

Bitquery's trace of the theft identified 233.5 million XRP transferred out of five Binance accounts during the Oct. 29 attack. Elliptic's subsequent balance estimates tracked a steady decline: about 192 million XRP remaining on Nov. 6, roughly 148 million on Nov. 7, about 95 million by early afternoon on Nov. 9, and about 60 million as of its Nov. 10 estimate — including approximately 33 million sitting in an address that had not moved since it was funded on Nov. 2.

In rounded figures, the remaining XRP stood at 192 million on Nov. 6 at 08:45 UTC; 148 million on Nov. 7, with the time unstated; 95 million by early afternoon on Nov. 9; and 60 million at 11:00 UTC on Nov. 10, 2026. These are dated balances rather than net completed-sale totals. Source: Elliptic update, Nov. 10, 2026, 11:00 UTC.

Elliptic also documented repeated interruptions along the swap route. According to the firm, THORChain halted XRP trading on Nov. 7, stalling swaps for nearly a full day, with successful swaps resuming from the afternoon of Nov. 8. On the morning of Nov. 10, XRP swaps again appeared halted, and new deposits were being refunded.

THORChain's documentation distinguishes between these states: a trading halt stops swaps while still permitting refunds, a signing halt queues outbound payments, and a full chain halt stops observation of the chain entirely. A pending payment, a returned XRP deposit, and a completed Bitcoin conversion therefore represent materially different outcomes.

A separate Nov. 9 reconstruction by Bitint put the XRP actually converted at no more than 93.85 million for its defined deposit population once refunds were corrected for. Bitint's Bitcoin settlement ledger cut off at Nov. 7 and was rechecked through Nov. 8.

Liquidity Sets the Pace

THORChain's streaming-swap mechanism splits an order into smaller parts, which can reduce slippage — the price cost of executing against available liquidity. When the parts are spaced out over time, arbitrageurs can rebalance the pools in between.

The protocol also records successful and unsuccessful amounts separately. A stream can pay out the converted value while returning the unsuccessful portion of the XRP, and a failed first attempt can trigger a full refund. Counting a deposit, its smaller executions, and its payout as separate sales would overstate activity.

Going forward, the most useful observations will be fresh balances in the remaining addresses, successful XRP conversions matched to their corresponding Bitcoin payouts, and the route's actual refund or halt status. The attacker's shrinking inventory limits what remains on this tracked leg, while usable liquidity and access govern how quickly it can be converted.

In its Nov. 10 update, Elliptic estimated that only a negligible amount had likely been cashed out across the wider laundering operation: much of the activity had merely changed the asset being held while leaving the funds on public blockchains, where analytics firms can continue tracing them. Selling XRP for Bitcoin reduces the attacker's XRP exposure even though the proceeds remain in crypto.