The stolen XRP stockpile from the October Binance breach is rapidly diminishing as attackers systematically convert their haul into Bitcoin. According to the latest data from blockchain analytics firm Elliptic, the remaining balance has plummeted to approximately 60 million tokens, signaling a sophisticated effort to pivot assets amidst broader market fluctuations.
A Rapidly Shrinking Stash
Since the initial theft of 233.5 million XRP across five Binance accounts on October 29, the attacker's holdings have seen a steady decline. By November 6, the reserve stood at 192 million XRP, but a series of aggressive conversions saw that number drop to 148 million by November 7 and roughly 60 million by November 10. A significant portion of this activity involves swapping XRP for Bitcoin, with an estimated 35 million tokens moved through THORChain in a single overnight surge. While XRP has experienced a 24% decline in value over the previous 30 days, it remains unclear how much of this weakness is directly attributable to the attacker’s liquidation efforts.
The Mechanics of the On-Chain Pivot
The conversion process has not been without its hurdles, as the attacker relies heavily on THORChain’s streaming-swap mechanism to manage liquidity and minimize price slippage. This protocol breaks large orders into smaller parts, allowing arbitrageurs to rebalance pools between executions to ensure the attacker receives the best possible rate. However, the operation has faced frequent interruptions; THORChain has implemented several trading and signing halts, leading to refunded deposits and queued payments. Despite these technical bottlenecks, the strategy effectively shifts the attacker's exposure from XRP into the relative stability of Bitcoin.
Conversion Versus Final Liquidation
While the stash of XRP is dwindling, blockchain analysts emphasize that most of these funds have not yet left the crypto ecosystem. Much of the laundering activity currently involves changing the type of asset held on public blockchains rather than cashing out into fiat currency. By converting to Bitcoin, the attackers are reducing their XRP-specific risks while maintaining their holdings in a more liquid digital asset. Elliptic estimates that only a negligible amount has been fully cashed out, as the majority of the proceeds remain visible on public ledgers, awaiting the next phase of the laundering operation.
