Binance hacker’s XRP stockpile rapidly crashes driven by Bitcoin swaps - Cryptonews.net

The $XRP stockpile linked to Binance's October hack has rapidly decreased to approximately 60 million tokens by Nov. 10, according to blockchain analytics firm Elliptic. This represents another significant round of conversions, with about 35 million additional $XRP swapped through THORChain overnight, almost entirely into Bitcoin.

Bitquery's theft trace identified 233.5 million $XRP sent from five Binance accounts during the Oct. 29 attack. Elliptic's tracking shows the remaining balance dropped from about 192 million $XRP on Nov. 6 to 148 million on Nov. 7, then to approximately 95 million by early afternoon Nov. 9, before reaching the current 60 million estimate.

Conversion Mechanism

THORChain's streaming-swap mechanism breaks large orders into smaller parts to reduce slippage, the price cost of executing against available liquidity. The protocol tracks successful and unsuccessful amounts separately, with streams paying out converted value while returning unsuccessful $XRP portions.

Elliptic reported that THORChain halted $XRP trading on Nov. 7, with swaps stopping for nearly a full day before resuming on Nov. 8 afternoon. On the morning of Nov. 10, $XRP swaps appeared halted again, with new deposits being refunded.

Market Impact

The laundering operation occurs during broader $XRP weakness, with the token down 24% over the previous 30 days. However, the laundering figures do not establish if this decline resulted from the attacker's conversions.

Elliptic estimated that a negligible amount had likely been cashed out across the wider laundering operation, with much of the activity changing the asset held while leaving funds on public blockchains. The next useful observations will be fresh balances in remaining addresses, matched successful conversions, and the route's actual refund or halt state.