$124 million has already been converted into Bitcoin—and doubled overnight 💥
💬 你站哪边？群里说
On November 6, blockchain analytics firm Elliptic reported that around 1,650 Bitcoin linked to the theft, worth approximately $124 million, had moved into new Bitcoin addresses—nearly double the amount from the previous day.
The route has changed once, too.
On November 2, around 233 million XRP was split across six new addresses. About 42 million XRP, worth roughly $50 million, has already been moved out. The remaining 192 million XRP, worth about $226 million, is still where it was.
Most of the new Bitcoin came from XRP being swapped directly for Bitcoin through the cross-chain exchange protocol THORChain. A small amount of Ethereum took the same route on the evening of November 5.
What’s worth watching isn’t the amount—it’s the pattern.
Stablecoins can be frozen by their issuers on command. In the major $6.3 billion case on October 29, around $3 billion had already been blocked on-chain. But Bitcoin has no issuer, and no one can make it disappear with the push of a button 🦖
So the attackers are doing something very simple: swapping assets that can be frozen for assets that can’t.
And they aren’t dumping everything at once. They’re swapping in batches, then slowly dispersing the Bitcoin. Every step is visible on-chain, but seeing it doesn’t mean you can stop it 📉
The market wasn’t cooperating that same day, either. Bitcoin was at $76,096, down 4.53% over 24 hours; Ethereum was at $2,240, down 6.40%; and XRP was at $1.19, down 8.41%.
In other words, they’re not selling at the best possible prices. It looks more like they’re moving their funds into a safer container.
My take: what really matters next isn’t those 1,650 Bitcoin, but the 192 million XRP and the larger amounts of other tokens—and whether they’ll keep moving into Bitcoin.
Once the transfers are complete, recovery will become even harder, because the gate controlled by stablecoin issuers simply doesn’t exist on the Bitcoin side.
That makes exchange deposit monitoring the only point where the funds can be intercepted. That’s why platforms have recently been tightening their address screening.
On-chain tracking can reveal every step, but tracking and recovery are two different things.
Bitcoin that’s already been swapped out can remain an untouchable string of addresses—as long as it doesn’t enter an account tied to someone’s identity.
Do you think the hackers are positioning themselves ahead of the next market cycle, or simply moving stolen funds? Let’s talk in the comments 👀
Every day, I bring you the latest in crypto security and fund flows—not just what’s happening, but the logic and opportunities behind it 👀🚀
Tap my profile picture to watch the livestream
💬 你站哪边？群里说
On November 6, blockchain analytics firm Elliptic reported that around 1,650 Bitcoin linked to the theft, worth approximately $124 million, had moved into new Bitcoin addresses—nearly double the amount from the previous day.
The route has changed once, too.
On November 2, around 233 million XRP was split across six new addresses. About 42 million XRP, worth roughly $50 million, has already been moved out. The remaining 192 million XRP, worth about $226 million, is still where it was.
Most of the new Bitcoin came from XRP being swapped directly for Bitcoin through the cross-chain exchange protocol THORChain. A small amount of Ethereum took the same route on the evening of November 5.
What’s worth watching isn’t the amount—it’s the pattern.
Stablecoins can be frozen by their issuers on command. In the major $6.3 billion case on October 29, around $3 billion had already been blocked on-chain. But Bitcoin has no issuer, and no one can make it disappear with the push of a button 🦖
So the attackers are doing something very simple: swapping assets that can be frozen for assets that can’t.
And they aren’t dumping everything at once. They’re swapping in batches, then slowly dispersing the Bitcoin. Every step is visible on-chain, but seeing it doesn’t mean you can stop it 📉
The market wasn’t cooperating that same day, either. Bitcoin was at $76,096, down 4.53% over 24 hours; Ethereum was at $2,240, down 6.40%; and XRP was at $1.19, down 8.41%.
In other words, they’re not selling at the best possible prices. It looks more like they’re moving their funds into a safer container.
My take: what really matters next isn’t those 1,650 Bitcoin, but the 192 million XRP and the larger amounts of other tokens—and whether they’ll keep moving into Bitcoin.
Once the transfers are complete, recovery will become even harder, because the gate controlled by stablecoin issuers simply doesn’t exist on the Bitcoin side.
That makes exchange deposit monitoring the only point where the funds can be intercepted. That’s why platforms have recently been tightening their address screening.
On-chain tracking can reveal every step, but tracking and recovery are two different things.
Bitcoin that’s already been swapped out can remain an untouchable string of addresses—as long as it doesn’t enter an account tied to someone’s identity.
Do you think the hackers are positioning themselves ahead of the next market cycle, or simply moving stolen funds? Let’s talk in the comments 👀
Every day, I bring you the latest in crypto security and fund flows—not just what’s happening, but the logic and opportunities behind it 👀🚀
Tap my profile picture to watch the livestream