Why Is Everyone Talking About XRP, 401(k)s and Gopax Today?

The wallets tied to the Binance theft have swapped about $50 million of stolen XRP into bitcoin, mostly through THORChain, Elliptic said in an update covering activity through Friday 6 November. About $226 million of XRP is still sitting in addresses linked to the theft.

That was one of several records set the same day. The US Department of Labor's final rule on alternative assets in 401(k) plans reached the White House for review, South Korea's Gopax stopped withdrawals and trading after an email threatening a hack, and the XRP Ledger closed a permission flaw that could have let issued tokens be minted without authorisation.

• The news: Launderers of the Binance theft have converted about $50 million of stolen XRP into bitcoin, Elliptic said, with about $226 million of XRP still unmoved.
• The figure: Elliptic puts the 29 October theft at $6.43 billion across 11 blockchains, with about $3.11 billion still in linked addresses.
• What's next: The 401(k) rule sits with the Office of Information and Regulatory Affairs, whose docket lists no legal deadline, and Gopax has given no date for resuming withdrawals.

Binance Hackers Are Converting XRP Into Bitcoin

Elliptic's running count is the clearest view of where the money went. All of the stolen SOL, about $87 million at current prices, has been swapped, bridged or mixed, and much of it now sits inside the roughly 1,650 BTC, worth about $124 million, that has been converted out of other stolen assets.

Behind those balances is a lot of small movement: more than 20,000 wallets on 16 blockchains, at least 36 services and at least 65,000 transactions. About $3.11 billion remains in linked addresses, mostly as ether and bitcoin, and $2.85 billion has been frozen or seized.

The drain is dated 29 October, but its size is still stated two ways. Binance has put it at $6.34 billion, while Elliptic's page says $6.43 billion was stolen that day. Both agree on the date and on the 11 blockchains involved.

Elliptic frames the whole operation around North Korea, publishing its analysis under the title "How North Korea is laundering the $6.4 billion stolen from Binance".

The 401(k) Rule Is With the White House, Not in Force

The Office of Information and Regulatory Affairs logged the package on 5 November as RIN 1210-AC38, titled "Fiduciary Duties In Selecting Designated Investment Alternatives", per the docket entry. It lists the Employee Benefits Security Administration as the authoring office, marks the stage as final rule and flags it as economically significant. It also notes there is no legal deadline for completion.

Review at that office is a procedural step that usually comes before a rule is released publicly. It is not the same as a rule in force, and nothing in the docket commits to a publication date.

What the rule would do was set out in the March 30 proposal: plan fiduciaries who follow a documented process get a legal safe harbour under ERISA when they select designated investment alternatives, with six non-exhaustive factors to weigh. Alternative assets are the category the rule targets, and crypto is the asset inside that category most 401(k) sponsors have avoided. The proposal carried a 60-day comment window after Federal Register publication.

The department's fact sheet says the proposal carries out Executive Order 14330, which states that every American preparing for retirement should have access to funds that include alternative assets when the plan fiduciary decides that access offers an appropriate opportunity to improve risk-adjusted returns.

Gopax Stopped Withdrawals at 2:55 p.m. and Trading at 3:53 p.m.

Gopax halted standard withdrawals at 2:55 p.m. and trading at 3:53 p.m. on Friday, after receiving an email from a party claiming it could hack the exchange. The exchange said it is moving all held assets to cold wallets and that no loss has been reported so far. An exchange official said the threat itself has not been verified.

In its own words: "To ensure the safe custody of user assets, we plan to transfer all virtual assets to cold wallets for storage." It added that direct withdrawals through the Gopax website or app are temporarily unavailable, and that customers should apply through the customer support centre.

One caveat worth knowing: the exchange's own notice page would not render readable text when checked, so those timings rest on the exchange's remarks to Korean media rather than on a notice we could read.

Gopax is not the only venue dealing with this. Brazil's Mercado Bitcoin froze deposits and withdrawals earlier this week after a security incident, with preliminary estimates of suspicious transfers near $40 million. The company said it had blocked $11 million with help from Tether, Circle, Paxos, BRL1 and Chainalysis, and deposits and withdrawals remain suspended with no restart date.

XRP Ledger Closed a Token-Minting Flaw on 4 November

The fixCleanup3_4_0 amendment activated on 4 November at 14:52 UTC, at ledger 108,112,129. It closes a permission flaw that could let an account authorised to burn issued tokens create new tokens under certain conditions.

Scope matters here. The flaw affected issued assets such as stablecoins and Multi-Purpose Tokens, not XRP's native supply, so if you hold XRP the amendment changes nothing about the asset itself.

Getting it live took two attempts. Validator support briefly fell below the required threshold on 21 October, restarting the mandatory 14-day approval window, and the second attempt ran 14 days and five minutes. No publicly confirmed exploitation of the vulnerability has been reported, and available disclosures do not name an issuer that suffered unauthorised token creation.

The amendment does not switch on the ledger's planned lending system, which needs separate validator approval and remains open for voting.

Hyperliquid Strategies Filed for a US Perps Licence

A subsidiary of Hyperliquid Strategies Inc has applied to become a futures commission merchant. Subject to regulatory approval, the unit would carry US client accounts for permissioned markets deployed on Hyperliquid under HIP-3, the Nasdaq-listed company said in its 5 November results release. This is an application, not a licence, and approval is not guaranteed.

The same release covers the quarter. HSI deployed $802 million in the three months to 30 September 2026, including $785 million to buy 9.1 million HYPE, lifting its treasury from 29.3 million tokens at 30 June to 38.5 million at 30 September. A further $17 million went to repurchasing 2.7 million PURR shares.

Across the twelve months to 30 September 2026, about $834 million in value accrued to the Hyperliquid ecosystem, much of it flowing to HYPE through programmatic buybacks. That figure is what makes the treasury strategy and the FCM application the same trade: fees generated by the protocol end up buying the token the company holds.

October Payrolls Beat the Prior Year's Monthly Average

The BLS Employment Situation put October nonfarm payrolls at a gain of 165,000, above the average monthly gain of 48,000 over the prior 12 months. Unemployment changed little at 4.1%. Average hourly earnings rose 14 cents, or 0.4%, to $38.00, and were up 3.1% over the year.

The next dated step in any of these stories is the release of the 401(k) rule once the regulatory office finishes its review, and no deadline forces that. On the laundering side, the number to watch is the $226 million of XRP still in linked addresses, down by the $50 million already converted into bitcoin.