The stolen Binance funds are still being swapped, with the hacker converting XRP into BTC.

The previous night, about 44 million XRP worth approximately $51 million was transferred out of addresses linked to the incident, most of it exchanged for Bitcoin through THORChain.

As of 16:00 on November 7, about 2,300 BTC worth $175 million had entered new Bitcoin addresses, mainly from exchanges involving other stolen assets. The addresses still hold about 148 million XRP worth approximately $173 million.

Another flow of funds went through mixers. During the same period, about 53 BTC worth $4 million entered CoinJoin mixing transactions on platforms such as Wasabi, bringing the total mixed to about 88 BTC, or $6.7 million.

The hacker's main BTC and ETH holdings have not yet been moved.

The funds have been steadily converted from XRP to BTC, but on-chain transfers do not mean the funds have been cashed out. The next challenge is tracking these cross-chain funds and determining whether they can be intercepted during mixing and subsequent transfers.