Binance hacker’s XRP stockpile rapidly crashes driven by Bitcoin swaps
The XRP stockpile linked to Binance's October hack had shrunk to about 60 million tokens by Nov. 10, after another round of conversions largely into Bitcoin.
The XRP stockpile linked to Binance's October hack had shrunk to about 60 million tokens by Nov. 10, according to blockchain analytics firm Elliptic, after another round of conversions largely into Bitcoin. Elliptic's Nov. 10 update reported about 35 million additional XRP swapped through THORChain overnight, almost all into Bitcoin.
The change comes during broader XRP weakness, which is down 24% over the previous 30 days. The laundering figures do not establish if that decline resulted from the attacker's conversions.
Shrinking reserve and swap route
Bitquery's theft trace identified 233.5 million XRP sent from five Binance accounts during the Oct. 29 attack. Elliptic put the remaining balance at about 192 million XRP on Nov. 6, about 148 million in its Nov. 7 account, and about 95 million by early afternoon Nov. 9.
Elliptic also described repeated interruptions, saying that THORChain halted XRP trading on Nov. 7, with swaps stopping for almost a day, and reported successful swaps again from Nov. 8 afternoon.
Liquidity sets the pace
THORChain's streaming-swap mechanism breaks an order into smaller parts that can reduce slippage, the price cost of executing against available liquidity. When parts are spaced apart, arbitrageurs can rebalance the pools between them.
In its Nov. 10 update, Elliptic estimated that a negligible amount had likely been cashed out across the wider laundering operation: much of the activity had changed the asset held while leaving funds on public blockchains.
The protocol also tracks successful and unsuccessful amounts separately. A stream can pay out the converted value and return the unsuccessful XRP portion, while a failed first attempt can trigger a full refund.
Related
