The hacker then sent XRP tokens through OKX, WhiteBIT and two non-custodial exchanges, among other destinations.