The hackers swapping XRP for BTC looks more like choosing a money-laundering route that is “harder to freeze and easier to absorb” than having already cashed out. For this assessment to hold, we would need to see the swaps continue, XRP balances keep falling, and BTC being dispersed or consolidated at the address level.
First, the facts. According to PANews, citing Elliptic’s tracking on November 6, around 1,650 BTC (approximately $124 million) linked to the Binance hack had entered new Bitcoin addresses—nearly twice the amount seen the previous day. Most of the newly added BTC came from swapping XRP for BTC through THORChain. Of the 233 million XRP transferred by the hackers to six new addresses on November 2, around 42 million (approximately $50 million) has been moved out, leaving about 192 million (approximately $226 million). A small amount of ETH was also swapped for BTC through THORChain on the evening of November 5.
My observation is that the key question about this route is not “what was it swapped for,” but “why was it swapped for that asset.” Once large addresses on the XRP Ledger are flagged, subsequent transfers are more likely to be monitored. THORChain enables cross-chain swaps, allowing assets to be converted into BTC, which has deeper liquidity, and then moved into numerous new addresses—making tracking and freezing more difficult. This is a preference driven by the mechanics of the process; it does not mean the hackers have secured their funds, nor does it mean BTC’s price will come under pressure as a result. The information available in this case provides no evidence of any sales or transfers to exchanges.
Based on this, three conditions are worth monitoring next: first, whether the remaining approximately 192 million XRP continues to flow out through THORChain; second, whether the new BTC addresses continue to spread the funds out or consolidate them into a small number of addresses; and third, whether there are signs that funds are entering centralized exchanges. If the swaps stall, XRP balances stop declining, or BTC addresses remain highly concentrated and inactive for an extended period, the assessment that the hackers “prefer the asset with the deepest liquidity” should be taken with a grain of salt. This article does not constitute investment advice.
$BTC
#BTC #ETH #XRP #Crypto Security
Sources:
PANews (originally published November 6 at 19:37 Beijing time)
https://www.panewslab.com/zh/articles/01a1b0a6-7321-7014-9237-e178276d3a05
First, the facts. According to PANews, citing Elliptic’s tracking on November 6, around 1,650 BTC (approximately $124 million) linked to the Binance hack had entered new Bitcoin addresses—nearly twice the amount seen the previous day. Most of the newly added BTC came from swapping XRP for BTC through THORChain. Of the 233 million XRP transferred by the hackers to six new addresses on November 2, around 42 million (approximately $50 million) has been moved out, leaving about 192 million (approximately $226 million). A small amount of ETH was also swapped for BTC through THORChain on the evening of November 5.
My observation is that the key question about this route is not “what was it swapped for,” but “why was it swapped for that asset.” Once large addresses on the XRP Ledger are flagged, subsequent transfers are more likely to be monitored. THORChain enables cross-chain swaps, allowing assets to be converted into BTC, which has deeper liquidity, and then moved into numerous new addresses—making tracking and freezing more difficult. This is a preference driven by the mechanics of the process; it does not mean the hackers have secured their funds, nor does it mean BTC’s price will come under pressure as a result. The information available in this case provides no evidence of any sales or transfers to exchanges.
Based on this, three conditions are worth monitoring next: first, whether the remaining approximately 192 million XRP continues to flow out through THORChain; second, whether the new BTC addresses continue to spread the funds out or consolidate them into a small number of addresses; and third, whether there are signs that funds are entering centralized exchanges. If the swaps stall, XRP balances stop declining, or BTC addresses remain highly concentrated and inactive for an extended period, the assessment that the hackers “prefer the asset with the deepest liquidity” should be taken with a grain of salt. This article does not constitute investment advice.
$BTC
#BTC #ETH #XRP #Crypto Security
Sources:
PANews (originally published November 6 at 19:37 Beijing time)
https://www.panewslab.com/zh/articles/01a1b0a6-7321-7014-9237-e178276d3a05
