The entities responsible for the $6.34B theft from Binance have increased the movement of their loot through the THORChain cross-chain bridge. Data from blockchain analytics firm Elliptic shows the attackers converted 35 million stolen XRP into Bitcoin, though they still hold approximately 60 million XRP. This activity comes as the network faces recurring instability; swaps on the protocol appeared to halt again on Nov 11, resulting in some new deposits being refunded to users.
The network’s intermittent operation follows an emergency pause on Oct 31 caused by an Ethereum chain reorganization that temporarily blocked all transactions, including those linked to the Binance hack. While THORChain later released a patch to resume services, some critics alleged that node operators manually pushed through transactions they knew belonged to the hackers despite pleas from the FBI to block them. Separately, Arkham Intelligence tracked 1,052.34 BTC, or $78.61M, leaving the thieves’ wallets between Nov 6 and Nov 11.
