Key Highlights
- Bitquery traced 233.5 million $XRP from five Binance accounts involved in the October 29 attack.
- Elliptic estimated that the tracked balance fell from about 192 million $XRP on November 6 to about 60 million by November 10.
- THORChain trading halts, refunds, liquidity and streaming swaps make completed conversions different from deposits or pending transactions.
The $XRP Reserve Continued to Shrink
Bitquery’s tracing of the October 29 attack identified 233.5 million $XRP sent from five Binance accounts. The remaining balance on the tracked route then declined sharply, according to successive estimates from blockchain analytics firm Elliptic.
Elliptic placed the remaining balance at approximately 192 million $XRP on November 6 at 08:45 UTC. The balance was estimated at about 148 million $XRP on November 7, approximately 95 million by the early afternoon of November 9, and about 60 million at 11:00 UTC on November 10, 2026.
The November 10 estimate included roughly 33 million $XRP held in an address that had remained unmoved since it was funded on November 2. These figures are dated balances at specific points in time, rather than confirmed totals for completed sales. Elliptic’s November 10 update provided the latest cutoff for the remaining tracked inventory.
THORChain Halts Complicated the Conversion Path
Elliptic also reported repeated interruptions affecting the route through THORChain. The protocol halted $XRP trading on November 7, causing swaps to stop for almost a day. Successful swaps were reported again from the afternoon of November 8. On the morning of November 10, Elliptic said $XRP swaps appeared to have halted again, with new deposits being refunded.
THORChain’s documentation distinguishes among several types of interruptions. A trading halt stops swaps while still allowing refunds. A signing halt queues outbound payments, while a full chain halt stops observation of the affected chain. As a result, a pending payment, a returned $XRP deposit and a completed conversion into Bitcoin represent separate transaction outcomes.
Bitint’s November 9 reconstruction estimated that no more than 93.85 million $XRP had actually been converted for its defined deposit population after accounting for refunds. Its Bitcoin settlement ledger ended at November 7 and was rechecked through November 8. That reconstruction therefore does not represent the entire remaining balance or necessarily cover later route activity.
Liquidity Determines How Quickly $XRP Can Move
THORChain’s streaming-swap mechanism divides an order into smaller executions. This can reduce slippage, the price impact caused by trading against available liquidity. Spacing the executions apart also gives arbitrageurs time to rebalance liquidity pools between parts of the order.
The protocol records successful and unsuccessful amounts separately. A stream can pay out the converted value while returning the portion of $XRP that was not successfully processed. A failed first attempt can instead trigger a full refund.
That distinction is important when assessing the activity. Counting the original deposit, its smaller executions and the final payout as separate sales would overstate the amount converted. More reliable measurements require fresh balances from the remaining addresses, matched records of successful $XRP conversions and Bitcoin payouts, and confirmation of whether the route is operating, refunding deposits or halted.
Why This Matters
The shrinking inventory limits what can still be converted through this tracked route, but the pace of any further movement depends on usable liquidity and access to the route. A declining $XRP balance does not, by itself, prove that an equivalent amount was sold successfully.
Elliptic estimated on November 10 that only a negligible amount had likely been cashed out across the wider laundering operation. Much of the observed activity had changed the asset being held while leaving the funds on public blockchains. Converting $XRP into Bitcoin reduces exposure to $XRP, but the proceeds remain in cryptocurrency unless they are later moved through another cash-out process.
Frequently Asked Questions
How much $XRP remained by November 10?
Elliptic estimated that about 60 million $XRP remained at 11:00 UTC on November 10, 2026, including roughly 33 million $XRP in an address that had not moved since its November 2 funding.
How much $XRP was confirmed as converted?
Bitint’s November 9 reconstruction put the amount actually converted at no more than 93.85 million $XRP for its defined deposit population after refund corrections. The figure is not a complete total for every balance or every later transaction.
Why do deposits and conversions show different totals?
THORChain streaming swaps divide orders into smaller executions, and unsuccessful portions may be returned. Pending payments, refunded deposits and completed Bitcoin conversions are different outcomes, so treating each transaction stage as a separate sale would overstate conversion activity.
