Tracked Binance-linked XRP reserve falls to 60 million tokens

By Tom Whitfield

About 60 million XRP remained in the tracked stockpile linked to Binance’s Oct. 29 attack as of 11:00 UTC on Nov. 10, 2026, according to Elliptic. The blockchain analytics firm said roughly 35 million additional tokens had moved through THORChain overnight, with almost all converted into Bitcoin.

Bitquery’s theft trace identified 233.5 million XRP sent from five Binance accounts during the attack. Elliptic’s successive measurements below record remaining balances, not net completed-sale totals.

What changed in the tracked reserve?

Elliptic’s rounded balance series shows the contraction across four cutoffs:

• Nov. 6, 08:45 UTC: 192 million XRP.
• Nov. 7, time unstated: 148 million XRP.
• Nov. 9, early afternoon: 95 million XRP.
• Nov. 10, 11:00 UTC: 60 million XRP.

The Nov. 10 estimate included roughly 33 million XRP in an address that had remained unmoved since its Nov. 2 funding. Elliptic also estimated that a negligible amount had likely been cashed out across the wider laundering operation; much of the activity changed the asset held while leaving funds on public blockchains.

XRP fell 24% over the preceding 30 days, but Elliptic’s laundering figures do not establish that the attacker’s conversions caused the decline. Selling XRP for Bitcoin reduces the token exposure even while the proceeds remain in crypto.

How did THORChain interruptions affect the route?

THORChain halted XRP trading on Nov. 7, stopping swaps for almost a day. Successful swaps resumed on the afternoon of Nov. 8. On the morning of Nov. 10, swaps appeared halted again, and the protocol refunded new deposits.

THORChain’s documentation says a trading halt “stops swaps while allowing refunds,” a signing halt “queues outbound payments,” and a full chain halt “stops observation of that chain.” The distinctions matter because a pending payment, a returned XRP deposit and a completed Bitcoin conversion represent different outcomes.

The stoppages constrained the immediate conversion route without removing the tracked assets by themselves. A depositor could receive XRP back, an outbound transfer could remain queued, or a Bitcoin payout could settle. Each outcome leaves a different footprint for analysts matching deposits, refunds and completed conversions.

How much XRP actually converted?

The report’s Nov. 9 reconstruction put actually converted XRP at no more than 93.85 million for its defined deposit population after correcting for refunds. The associated Bitcoin settlement ledger cut off on Nov. 7, and the reconstruction rechecked that record through Nov. 8.

The 93.85 million estimate does not measure the full 233.5 million theft trace. It applies only to the reconstruction’s defined deposit population and reflects refund corrections, so the two figures cannot be treated as equivalent.

THORChain’s streaming-swap mechanism divides an order into smaller parts, which can reduce slippage, or the price cost of executing against available liquidity. When those parts arrive with gaps between them, arbitrageurs can rebalance the pools between executions.

The protocol tracks successful and unsuccessful amounts separately. A stream can pay out the converted value and return the unsuccessful XRP portion, while a failed first attempt can trigger a full refund. Counting the deposit, its smaller executions and its payout as separate sales would overstate completed activity.

What should observers track next?

Fresh balances in the remaining addresses, matched successful XRP conversions and Bitcoin payouts, and the route’s actual refund or halt state provide the clearest tests for the next update. Smaller inventory limits what remains on this tracked leg, while usable liquidity and access govern how quickly it can convert.

With about 60 million XRP left at the Nov. 10 cutoff, THORChain’s pool liquidity, refund settings and halt procedures will determine how quickly the tracked inventory can reach Bitcoin. Matched balances and payouts will show whether future movement represents completed conversion or another change in the route.