The relevant addresses left behind by the previous Binance theft incident have been lit up again: According to blockchain analysis company Elliptic, as of November 7, 16:00 Beijing time, approximately 44 million XRP (about 51 million USD) have flowed out from these addresses, most of which were directly exchanged for Bitcoin via the cross-chain protocol THORChain, ultimately aggregating into about 2,300 BTC (approximately 175 million USD) transferred to new Bitcoin addresses; while the publicly available on-chain information shows that this series of fund paths still mainly comes from a single source report. Meanwhile, about 148 million XRP (approximately 173 million USD) remains untouched on the relevant addresses, raising the suspense of when this substantial amount of assets will be moved and along what cross-chain path they will migrate, becoming the next layer of mystery surrounding this security incident. At the same time, as external parties keep a close eye on on-chain trends, Binance announced the appointment of Justin Yek as the new Chief Financial Officer, while the current financial head Kaiser Ng will leave after more than five years in the role; co-CEO He Yi stated externally that this CFO handover plan has been in progress for about six months, earlier than the related arrangements around October 29, but whether the security incident and the executive change are purely coincidental in timing or will force the exchange to make more adjustments in internal governance and risk control has already become a new focus of market discussion.
44 million XRP escape: Stolen funds exchanged for Bitcoin
According to Elliptic's monitoring, among the addresses previously marked as related to the Binance theft incident, about 44 million XRP have been gradually transferred out, most of which did not stay in traditional centralized exchanges but were directly exchanged for Bitcoin via the cross-chain protocol THORChain. Elliptic pointed out that as of November 7, 16:00 Beijing time, this chain of funds has ultimately deposited about 2,300 BTC on the Bitcoin network, valued at about 175 million USD, contrasting sharply with the static assets previously held on the XRP addresses.
More notably, there are still approximately 148 million XRP (about 173 million USD) on the same group of relevant addresses that have not been moved, indicating that the attackers neither emptied the chips in one go nor immediately completely "abandoned" these addresses. For external observers, this path of "escaping from XRP, exchanged via THORChain, and ultimately landing in BTC" translates the scale and risk of the incident from a single token's balance number into a long-term exposure dimension on Bitcoin, turning what could have been seen as an isolated project risk into a compliance and risk control exam question on mainstream assets.
THORChain: A stepping stone for cross-chain laundering?
THORChain is essentially a cross-chain exchange protocol aimed at multi-chain assets, allowing users to directly swap native assets between different public chains without needing to first "land" on a single chain as homogeneous assets. According to public information, some of the XRP related to the Binance theft incident have been exchanged for Bitcoin using this mechanism. Elliptic's monitoring shows that most of the approximately 44 million XRP transferred out were exchanged through THORChain, aggregating into about 2,300 BTC that appeared in new addresses as of November 7, 16:00, clearly marking THORChain as part of the entire funding movement in this incident.
Structurally, such decentralized cross-chain exchange protocols lack a single centralized custodian; on-chain matching and settlement are scattered among multiple nodes, lacking a central point that can simply issue "freeze" orders, which has been widely discussed in the industry. For attackers, as long as they can complete a deposit on one side chain, they can obtain withdrawal targets on the other side chain, thus achieving "shell-switching" on asset forms, chains, and even address systems, objectively raising the threshold for subsequent tracking and risk control collaboration. However, this does not mean THORChain itself bears moral attributes; at the protocol level, it remains a neutral tool, with the true exposure being that the cross-chain ecosystem has yet to form a consistent consensus and interlinking mechanism across protocols and chains in terms of anti-money laundering standards, list sharing, and response processes.
Elliptic in pursuit: A tug-of-war between trackers and attackers
In this pursuit of the stolen funds, the core "map" comes from blockchain analysis company Elliptic. Its monitoring report shows that assets related to the theft, such as XRP, have been exchanged for Bitcoin on-chain, layered along the path of "XRP → BTC → new address." As of November 7, 16:00 Beijing time, approximately 2,300 BTC have been transferred to new Bitcoin addresses, and Elliptic simultaneously pointed out that about 148 million XRP remain in the relevant addresses, yet to be further moved. These figures currently appear from a single source, with no multiple institutions cross-validating, so readers need to allow for uncertainties in statistical criteria and recognition methods when judging the specific scale and impact of this fund transfer.
From a longer time frame, this is a typical tug-of-war between "on-chain trackers" and attackers. The former attempts to restore the complete path along publicly verifiable transaction records and address relationships, while the latter uses cross-chain protocols, decentralized exchanges, and different asset forms to continuously break apart paths and reorganize links, trying to obscure sources and destinations. Cross-chain tools like THORChain make "chain-switching and shell-switching" low-threshold but likewise exponentially increase tracking complexity; however, as long as these assets ultimately remain on public blockchains, any large movements will be exposed again under on-chain analytics.
Binance's financial reshuffle amid security turmoil
Just as on-chain monitoring institutions were tracking approximately 44 million XRP being exchanged for Bitcoin via THORChain, with about 2,300 BTC transferred to new addresses, Binance publicly announced the appointment of Justin Yek as the new Chief Financial Officer, while the current financial head Kaiser Ng will leave after more than five years in the role. Co-CEO He Yi stated that Kaiser Ng chose to embark on a new career direction for personal professional planning, and that this handover plan has progressed for about six months, earlier than the related arrangements around October 29, with the official narrative clearly attempting to separate the financial leadership change from the current security incident.
However, beyond the narrative, the overlap of timelines itself is enough to stimulate market associations: one side is the large asset conversion and cross-chain movement from the addresses related to the theft, while the other is the personnel change of those in charge of funds and reports; even if the official emphasizes that there is no causal relationship between the two, investors may still reassess Binance's internal governance structure, risk control processes, and financial transparency. When core executive changes coincide with unusual on-chain fund movements, external parties often do not view it merely as a simple personnel announcement but as an opportunity to examine whether the platform can withstand ongoing scrutiny regarding risk control, compliance, and information disclosure.
Seeking the next signal amid cross-chain fog
This incident brings an old problem to the forefront: when stolen assets can linger in a specific address for a long time before being rapidly exchanged into Bitcoin through cross-chain protocols like THORChain, resulting in about 44 million XRP becoming approximately 2,300 BTC transferred to new Bitcoin addresses, traditional on-chain tracing and anti-money laundering tools that rely on single-chain paths are forced to confront the reality of technological neutrality combined with cross-chain complexity. Going forward, the most intuitive observation variable on-chain will be whether the approximately 148 million XRP still remaining in the relevant addresses continue to be split and transferred, and whether potential new paths will also be used for exchanging into BTC; off-chain, it concerns how users and regulators view whether Binance presents more verifiable compliance, risk control, and information disclosure measures following this round of security pressure and CFO transition, as well as whether cross-chain protocols, including THORChain, will actively respond to external doubts about their compliance roles. In the longer term, how security incidents at exchanges are handled, how cross-chain tools are used, and the governance rhythm at the C-suite level of leading platforms will continue to intertwine into a common narrative, reshaping the industry's understanding framework of risk boundaries and transparency.
Join our community, let's discuss and become stronger together!
AiCoin exclusive Hyperliquid benefits: https://app.hyperliquid.xyz/join/AICOIN88
AiCoin exclusive Aster benefits: https://www.asterdex.com/zh-CN/referral/9C50e2
On-chain Telegram community: https://t.me/AiCoinWhaleData
On-chain community: https://www.aicoin.com/link/chat?cid=N6OVMor5g
AiCoin on-chain Twitter: https://x.com/aicoinwhaledata
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到[email protected]，本平台相关工作人员将会进行核查。
