Elliptic: $124M in Binance Hack Funds Converted to BTC, Nearly Double Prior Day

The shift from XRP into Bitcoin via THORChain matters because it shows the attacker is actively rotating assets across chains rather than letting them sit, which complicates tracing and recovery. The near-doubling of BTC inflows in a single day signals acceleration, not a one-off move. With roughly 192 million XRP still parked in the six flagged addresses, the open question is whether that remainder gets converted at the same pace or stalls — that conversion rate is the clearest real-time gauge of how much of the haul is being laundered versus held.