- The Binance attacker moved all 233.46 million stolen XRP into six fresh wallets on November 2.
- Native XRP has no issuer that can freeze it, so exchanges are the main choke point.
- None of the six wallets had sent funds onward as of November 3.
The hacker behind Binance’s ~$6.3 billion hack moved all 233.46 million stolen XRP to 6 new wallets on Monday.
Unlike the stablecoins also taken in the theft, native XRP has no issuer who can freeze it.
Nine payments emptied the holding address in eight minutes
According to the XRP Ledger records, the holding address made six test payments of 1,000 XRP each starting at 03:47 UTC. Between 03:52 and 04:00 UTC, nine large payments were made.
In the end, five wallets took in about 40 million XRP each. Three got it in two installments: 30 million and 10 million.
The sixth took 33.46 million. The original address retained 23.7 XRP.
At Monday’s price of ~$1.26 for XRP, the coins were worth about $294 million. Whale Alert spotlighted a single transfer of 40 million XRP worth around $50.4 million from an address it labels as “Binance Hack 2026.”
The attacker also sent 1,000 XRP to a seventh, separate address at 02:12 UTC. The coins were in the holding address for around 80 hours before the large payments were made.
Five Binance wallets sent the whole 233.46 million XRP to that address in about four minutes on October 29. Ledger data at 07:27 UTC Tuesday revealed none of the six new wallets had sent anything out.
Gate took in $250,000 of the loot over 12 hours
As per the XRP Ledger docs, native XRP cannot be frozen on the ledger. Ripple froze stolen RLUSD tied to the breach, but those issuer controls only go so far as its own stablecoin.
Now the task is to trace the six wallets and for exchanges to reject deposits to get back the XRP.
The split appears to be a laundering step. Six balances mean more trails to follow and smaller lots to cash out.
On-chain tracker Lookonchain said around $250,000 of the plunder was moved to the exchange Gate over 12 hours.
The attack resulted in about $628 million in assets being stolen on Tron. Tether froze around 378.7 million USDT, but analyst SomaXBT estimates that about $242 million slipped out through Tron-linked routes in two days.
Some $140 million of it passed through services such as Relay and THORChain, whose node operators were asked by the FBI to block the funds. Those estimates put Relay’s volume at almost $48 million and THORChain’s at $44 million.
Cryptopolitan reported that the industry has frozen around $3 billion of the stolen assets. The FBI blames TraderTraitor, the name it gives to a state-linked North Korean hacking operation, saying the attackers are turning stolen crypto into Ether.
However, North Korea’s Kim Yo Jong denied the FBI’s accusation, calling it “an absurd rhetoric and nothing new,” in an official statement released November 2.
Binance said company funds have compensated about 95% of the amount affected. The exchange also said it has full backing for its XRP balances.
Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.
FAQs
Why can't Ripple freeze the stolen XRP?
Native XRP has no issuer with freeze power, so the controls Ripple used on stolen RLUSD do not reach it.
How much XRP was moved and where did it go?
The attacker moved all 233.46 million XRP into six fresh wallets between 03:52 and 04:00 UTC on November 2.
Who does the US blame for the Binance hack?
The FBI blames North Korea, through a state-linked hacking operation it calls TraderTraitor. However, North Korea denied the accusations.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
