Binance hacker’s XRP stockpile rapidly crashes driven by Bitcoin swaps

The XRP stockpile linked to Binance's October hack had shrunk to about 60 million tokens by Nov. 10, according to blockchain analytics firm Elliptic, after another round of conversions largely into Bitcoin.

Elliptic's Nov. 10 update reported about 35 million additional XRP swapped through THORChain overnight, almost all into Bitcoin.

The change comes during broader XRP weakness, which is down 24% over the previous 30 days. The laundering figures do not establish if that decline resulted from the attacker's conversions.

The shrinking reserve and its swap route

Bitquery's theft trace identified 233.5 million XRP sent from five Binance accounts during the Oct. 29 attack.

Elliptic put the remaining balance at about 192 million XRP on Nov. 6, about 148 million in its Nov. 7 account, and about 95 million by early afternoon Nov. 9. Its Nov. 10 estimate was about 60 million, including roughly 33 million in an address that had remained unmoved since its Nov. 2 funding. About 60 million XRP remained at Elliptic's November 10 cutoff

Rounded XRP remaining: 192 million on November 6 at 08:45 UTC; 148 million on November 7, time unstated; 95 million by early afternoon November 9; 60 million at 11:00 UTC November 10, 2026. These are dated balances, not net completed-sale totals.{#cs-chart-1-description}

Retry chart View the data table below.
Chart by CryptoSlate
Source: Elliptic update, November 10, 2026, 11:00 UTC View dataHide data

| Category | Approx. XRP remaining | | Nov 6, 08:45 UTC | 192 million XRP | | Nov 7, time unstated | 148 million XRP | | Nov 9, early afternoon | 95 million XRP |

Elliptic also described repeated interruptions, saying that THORChain halted XRP trading on Nov. 7, with swaps stopping for almost a day, and reported successful swaps again from Nov. 8 afternoon. On the morning of Nov. 10, it said XRP swaps appeared halted again, with new deposits refunded.

THORChain's documentation says a trading halt stops swaps while allowing refunds, a signing halt queues outbound payments, and a full chain halt stops observation of that chain. A pending payment, a returned XRP deposit, and a completed Bitcoin conversion represent different outcomes.

Bitint's Nov. 9 reconstruction put XRP actually converted at no more than 93.85 million for its defined deposit population after refund corrections. Its Bitcoin settlement ledger cut off at Nov. 7, and was rechecked through Nov. 8.

Liquidity sets the pace

THORChain's streaming-swap mechanism breaks an order into smaller parts that can reduce slippage, the price cost of executing against available liquidity. When parts are spaced apart, arbitrageurs can rebalance the pools between them.

The protocol also tracks successful and unsuccessful amounts separately. A stream can pay out the converted value and return the unsuccessful XRP portion, while a failed first attempt can trigger a full refund.

Counting the deposit, its smaller executions, and its payout as separate sales would overstate activity.

One XRP deposit can have different endings

Execution, refunds and outbound settlement answer different questions. Explore the protocol outcomes behind a wallet departure.
XRP transfer Deposit execution check ? Wallet Outcome A deposit alone does not establish conversion.
XRP Deposit ? Wallet Outcome Deposit ≠ completed conversion

Follow the deposit

Follow the depositPartial conversionFull refundOutbound queued
Successful parts pay out Bitcoin; unsuccessful parts return XRP. The deposit amount is not the converted amount.
XRP deposit Swap successful portion unconverted portion Bitcoin paid out XRP returned
XRP deposit Swap unconverted swapped XRP returned Bitcoin paid out
If the first streaming attempt fails, the entire XRP deposit can be refunded. A wallet departure need not become a sale.
XRP deposit First attempt fails No conversion Entire XRP deposit returned
XRP deposit First attempt fails No conversion Entire XRP deposit returned
A signing halt queues outbound payments. Execution and receipt of the payout are separate steps.
XRP deposit Swap Payout queued signing paused A delayed outbound is a settlement state.
XRP deposit Swap signing paused Payout queued

Match successful execution with payouts and refunds before counting converted XRP.

Protocol mechanics only, not a chronology of attacker transactions or a statement of current route status. No throughput, proportions or attacker-specific streaming settings are established.
Sources and evidence

Sources

1. Elliptic dated observations
2. THORChain halt controls
3. THORChain streaming execution

Supporting facts

• THORChain documentation distinguishes a trading halt, which stops swaps and permits refunds, from a signing halt, which queues outbound payments, and a full chain halt, which stops chain observation. [2]
• A transfer or deposit alone does not establish completed XRP-to-Bitcoin conversion; successful execution, pending settlement and returned XRP are different states. [2] [3] [1]
• For streaming swaps, THORChain tracks successful and unsuccessful amounts, pays out successfully swapped value, and refunds the remaining source asset; a failed first attempt can refund the whole stream. [3]

Method

Qualitative protocol diagrams from the retained THORChain halt and streaming documentation. Paths show possible asset and settlement states, not amounts or probabilities.

Scope

Protocol mechanics only, not a chronology of attacker transactions or a statement of current route status. No throughput, proportions or attacker-specific streaming settings are established.
Infographic by CryptoSlate

The next useful observations are fresh balances in the remaining addresses, matched successful XRP conversions and Bitcoin payouts, and the route's actual refund or halt state.

Smaller inventory limits what remains on this tracked leg, and usable liquidity and access govern how quickly it can be converted.

In its Nov. 10 update, Elliptic estimated that a negligible amount had likely been cashed out across the wider laundering operation: much of the activity had changed the asset held while leaving funds on public blockchains.

Selling XRP for Bitcoin reduces that XRP exposure even while the proceeds remain in crypto.