Blockchain analytics firm Elliptic said this morning that XRP stolen in the October 29 Binance breach has started moving into bitcoin. By early Friday, roughly $50 million of that XRP had been swapped, mostly through THORChain, with about $226 million still in addresses linked to the theft. XRP itself slid to about $1.18, an 11-week low. The two should not be mashed into one cause-and-effect headline.
XRP market moves
XRP opened November 6 (00:00 UTC) at about $1.21, market cap near $76.6B, with about $2.19B in 24-hour volume (CoinGecko). The session range ran from about $1.17 to $1.24, and the New York close sat near $1.18. That is several percent below yesterday's late-day level, and the weakest print since late August. The broader tape was heavy; this was not an XRP-only breakdown.
What Elliptic reported
Elliptic's running report on the Binance theft, updated through 08:45 UTC today, says the XRP started being laundered on the afternoon of November 5. Two of the six addresses that received the coins on November 2 forwarded them to dozens of new accounts, which then swapped them, mostly via THORChain, into bitcoin.
The Block, writing from that update at 1:06 PM ET, said the converted bitcoin from other stolen assets had reached about $124 million (roughly 1,650 BTC), on top of about $1.48 billion in bitcoin taken in the original attack. The largest slice of that newly converted total came from the XRP route. Bitcoin Magazine put the swapped XRP at about 42 million tokens, or roughly $50 million, with about 192 million XRP still outstanding.
Elliptic still estimates that only a negligible amount has been cashed out. The laundering has used more than 20,000 wallets across 16 blockchains and tens of thousands of transactions. The firm rejected speculation that AI agents were making the decisions: the process is automated, it said, but not in the way those posts implied.
The FBI has attributed the campaign to North Korea's TraderTraitor group. Binance has said it covered customer balances and has frozen or intercepted about $2.85 billion. Those figures are the companies' and Elliptic's, not an XRPTRACER audit.
What this is not
It is not a new hack. The 233.46 million XRP left Binance hot wallets on October 29. It is not evidence that "XRP is being dumped on your market" in the ordinary sense of holders selling. Stolen coins moving through a cross-chain swap are a law-enforcement and exchange-security story. They can add supply into bitcoin and into swap pools; they do not, on today's evidence, explain an 11-week low by themselves.
THORChain had halted most swaps on October 31 after a technical fault. The FBI published attacker addresses that evening and urged node operators to block them. Elliptic says swaps later resumed, and the first $50 million of XRP went through regardless. The report does not say how much, if any, was blocked along the way.
Other verified items today
Teucrium filed a Form 485BXT to delay effectiveness of its 2x Short Daily XRP ETF until December 5, 2026. A delay of effectiveness is not a listing date, and it is not a short position in the market today.
A 140.35 million XRP payment between two unnamed wallets was confirmed on-ledger around late morning. Neither side had an exchange label on XRPSCAN or Bithomp in our check. Large unlabeled payments are not, by themselves, sales.
Question everything
Some posts will treat every dollar of swapped XRP as spot selling pressure. Elliptic is describing swaps into bitcoin, not a documented sell print on a named XRP order book. The remaining ~$226 million can still move. Until it does, do not invent a size or a venue.
What people are talking about
The 11-week low is dominating the feed. The Elliptic note is being read, in some corners, as if it were the cause. That is a leap. Watch the remaining balance, not the vibe.
On-chain data
XRP price: about $1.21 at 00:00 UTC; session low about $1.17, late levels near $1.18 (CoinGecko)
Market cap: about $76.6B at the daily snapshot (CoinGecko)
24h volume: about $2.19B (CoinGecko)
Stolen XRP swapped (Elliptic, early Friday): ~$50M / ~42 million tokens
Stolen XRP still in linked addresses: ~$226M / ~192 million tokens
RLUSD on XRPL: about 885–910 million through the day, then 884.5 million by evening (ledger)
Flows and macro
U.S. jobs data beat in the morning tape, but crypto did not catch a bid. We did not have a complete Friday ETF print at deadline; the week's flow picture is tomorrow's story if the flat stretch holds.
What to watch next
Elliptic's next update on the remaining XRP balance
Whether THORChain or other venues publish any block rate on the FBI address list
Binance's staged withdrawal reopenings, already underway for some networks
Whether XRP holds the late-August lows or looks through them next week
The XRPTRACER take
Elliptic's update is a verified movement of stolen coins, not a thesis about XRP's fundamentals. The remaining stack is still large. The price sitting at $1.18 needs a market explanation — flows, leverage, the post-hack tape — not a single swap route. We've logged the Elliptic figures on the Catalyst Tracker. Price and on-chain alerts sit on the Dashboard.
Sources: Elliptic: how the Binance theft is being laundered · The Block, Nov 6 · Bitcoin Magazine: $50M XRP swapped · CoinGecko XRP
Price is CoinGecko's daily snapshot at 00:00 UTC on November 6, 2026, with the session range from the same day's CoinGecko chart. Laundering figures are Elliptic's as of about 08:45 UTC, as reported by Elliptic and The Block.
Not investment advice. See our Disclaimer.
XRPTRACER Catalyst signup block (mirrors SOLTRACER /catalyst-tracker bottom CTA)
XRPTRACER Pro
Unlock the full Catalyst Tracker.
The full price-reaction breakdown, every move with sources and CSV, the weekly Build-vs-Price Gap, The Crowd Tracker and Catalyst Alerts by email (app notifications coming soon). Prefer free? Join the weekly newsletter.
$29/mo or $249/yr