According to @zachxbt, Haby swapped his portion of the theft proceeds from XRP to BTC via instant exchanges (source: ZachXBT on X, Dec 29, 2025, post 2005649194435195201). According to @zachxbt, a timing analysis identified the BTC address bc1qn3k5cz3905p6k50r44pjlj2rl9qcy72flsq3zh for these flows (source: ZachXBT on X, Dec 29, 2025, post 2005649194435195201). According to @zachxbt, the concrete path XRP -> instant exchanges -> BTC and the disclosed address provide a direct on-chain indicator for traders to monitor potential movements linked to the reported theft proceeds (source: ZachXBT on X, Dec 29, 2025, post 2005649194435195201).