Four Minutes, $6.34 Billion, and 192 Million XRP Still Waiting to Become Bitcoin

Four minutes. That's the window. Between 20:05 and 20:09 UTC on Oct. 29, five Binance hot wallets pushed 233.46 million XRP to a single attacker address. Binance later put the whole drain at $6.34 billion. The FBI pinned it on North Korea's TraderTraitor group.

Then the stolen XRP sat there. Nearly three days of silence, which is its own kind of tell. Early on Nov. 2, all 233 million tokens moved into six fresh addresses. They stayed parked until Nov. 5. From the afternoon of that day, two of the six started fanning XRP out to dozens of new accounts, and those accounts swapped it, mostly through THORChain, into bitcoin.

As of Elliptic's latest update, roughly 42 million XRP has gone through that pipe. Call it $50 million. Converted bitcoin from the stolen pile nearly doubled overnight to about 1,650 BTC, worth somewhere near $124 million. Most of that jump came from the XRP route alone. Another 192 million XRP, about $226 million, is still sitting in addresses linked to the theft.

The kill switch problem

Here's the part that actually matters. Stablecoin issuers can freeze your tokens. Tether and Circle locked down large tranches on Oct. 29, the same day as the hack. So the attacker did what any rational operator does when half the market ships with a remote off switch. They moved into the assets that don't have one.

You can't freeze XRP the way you freeze a USDT balance. You definitely can't freeze bitcoin. Swapping one for the other isn't some clever laundering trick. It's a flight to un-freezable territory, and it's the second time we've watched it happen at scale after Bybit.

That framing should make people uncomfortable. The freeze function that makes stablecoins feel safe to institutions is the exact thing that pushes stolen capital into bitcoin. Every compliance win on one side creates demand on the other. That's not a bug in the design. That's the design, and pretending otherwise is how you end up surprised every single time.

The rest of the trail is genuinely enormous. Elliptic has counted more than 20,000 wallets across 16 blockchains, at least 36 services and at least 65,000 transactions since the theft. That's roughly one new wallet every 30 seconds and one transaction every 10. About $3.11 billion remains in linked addresses, mostly as ether and bitcoin. Very little has actually been cashed out.

All the stolen SOL, around $87 million at Elliptic's prices, is already swapped, bridged or mixed, with much of it landing in BTC. Some $220 million in TRX has mostly run too. Only small slices of the main ether and NEAR piles have budged. And the fattest targets, the big bitcoin and ether pools, haven't moved at all.

Some of the converted bitcoin went into Wasabi-style coinjoins. About 33 BTC, roughly $2.5 million, since Nov. 1. Another $1.1 million in ETH and SOL walked into the Privacy Cash pool before that service paused deposits. Small numbers, big habits.

THORChain is the new choke point

Elliptic's read on the speed is that it looks like conventional automation, not an AI agent making live calls. Fixed timing, set amounts, blind retries, new tactics rolled out hours apart.

Honestly, that's scarier in a boring way. A machine that works this steadily means this is a repeatable playbook, not a smart person at a keyboard improvising. You can copy a playbook. You can rent it out. And you can run it while you sleep.

So where's the use point now? It's not the exchanges. Binance has frozen or intercepted about $2.85 billion and covered customer losses out of its own funds, and withdrawals are back open in stages. That's a real number and a real response. But it's mostly stablecoin and exchange-side money. The attacker already routed around it.

The use point is the bridges.

THORChain operators are quietly acting as the compliance layer for this entire operation, whether they wanted the job or not. They've been blocking published attacker addresses. The open question is whether they can keep blocking fast enough to slow the XRP-to-bitcoin pipe, or whether the remaining 192 million tokens follow the same overnight path the first $50 million took.

That's an awkward spot for a protocol that markets itself on not being stoppable. But this is where the meta shifted. Keep up. The fight over digital ownership stopped being about who controls your assets and started being about who can hit pause on a swap at 3 a.m. Whether you think that's good or bad, it's happening, and the operators in the middle are the ones making the call now.

Meanwhile U.S. bank supervisors have already checked in with lenders after the breach. Read that again. Bank examiners, poking at a crypto exchange hack, because the contagion question stopped being theoretical. For bitcoin markets, that's the more interesting signal than the price chart.

The 192 million question

Here's my honest read. The hack is over. The exit isn't. And the exit is where this gets decided.

Flows like this put pressure on bitcoin's liquidity and its optics at the same time. Some analyst somewhere will look at an uptick in BTC volume from fresh addresses and call it adoption. It isn't. It's laundering with extra steps, and the market should learn to tell the difference before a headline does it for them.

But the harder truth is that bitcoin keeps winning these moments precisely because nobody can reach in and freeze it. That's the property that makes it worth holding through a bear market. It's also the property that makes it the preferred endpoint for a $6.34 billion theft. You don't get to pick one half of that trade. It's bundled.

So the real test isn't Elliptic's wallet count or Binance's recovery number. The test is whether bridges and swap operators can move faster than a script that's already running, and whether they'll keep doing it once the news cycle moves on. If they do, the remaining 192 million XRP stays stuck. If they don't, it becomes bitcoin by the weekend.

Watch that pile. Floor price is a distraction. The 192 million is the signal.