A hacker linked to the Binance breach reportedly shifted all 233.46 million stolen XRP, valued at about $294 million, into six new wallets on Monday. The asset movement has drawn attention due to the immutable and non-freezable nature of native XRP within the XRP Ledger. Ripple, the company behind the XRP payment protocol, cannot intervene to halt transactions involving native XRP.
Rapid redistribution across new wallets
Records from the XRP Ledger show the hacker’s initial holding address began by making six test transfers of 1,000 XRP each at 03:47 UTC. Nine large payments quickly followed between 03:52 and 04:00 UTC, dispersing the total stolen amount across the six new wallets.
Five of these wallets each received around 40 million XRP. In three cases, the transfer was split across two installments—30 million and 10 million. The sixth wallet was credited with 33.46 million XRP. Only 23.7 XRP remained in the original source address after the transactions.
At Monday’s market rate of approximately $1.26 per XRP, the value of the redistributed coins totaled close to $294 million. Whale Alert, a well-known on-chain monitoring service, highlighted a particularly large movement of 40 million XRP (about $50.4 million) traced to the address labeled “Binance Hack 2026.”
Whale Alert tracked a 40 million XRP transfer valued at $50.4 million from a wallet associated with the so-called Binance Hack 2026, emphasizing the scale of the stolen funds’ movement across the network.
Earlier, on the same Monday, the attacker transferred 1,000 XRP to a separate, seventh address at 02:12 UTC. The bulk of the funds had remained in the initial holding address for roughly 80 hours before these substantial outflows occurred.
Tracing the funds and laundering tactics
On October 29, the full 233.46 million XRP landed at the holding address in roughly four minutes via transfers from five different Binance wallets. According to XRP Ledger data from 07:27 UTC Tuesday, the six new wallets have not moved any funds since receiving them.
The transfer pattern—splitting assets into multiple wallets—appears to be a classic laundering method. Dividing large sums across several addresses complicates tracking and can help evade exchange detection when attempting to liquidate the stolen assets.
| Wallet | XRP Received |
|---|---|
| Wallet 1 | ~40 million |
| Wallet 2 | ~40 million |
| Wallet 3 | ~40 million |
| Wallet 4 | ~40 million |
| Wallet 5 | ~40 million |
| Wallet 6 | 33.46 million |
Over a 12-hour period, around $250,000 of the stolen XRP was sent to the cryptocurrency exchange Gate, according to Lookonchain, an on-chain analytics provider. Analysts stress that although Ripple was able to freeze RLUSD stablecoins connected to the incident, native XRP cannot be frozen or clawed back due to its decentralized structure.
Efforts are now centered on tracing the six destination wallets and urging cryptocurrency exchanges to block deposits coming from these addresses to recover as much of the stolen XRP as possible.
Mini dictionary: Whale Alert is a blockchain analytics platform that monitors large and unusual transactions across major blockchains, providing real-time alerts of significant fund movements such as exchange hacks or whale activity.
Industry response and ongoing investigation
The Binance hack involved the theft of about $628 million worth of digital assets on the Tron network. Tether moved to freeze $378.7 million in USDT following the event, but blockchain investigator SomaXBT estimates that $242 million exited through Tron-linked channels within two days.
Of these escaped funds, roughly $140 million flowed through cross-chain services such as Relay and THORChain. The FBI has contacted node operators on these platforms to request the blocking of suspicious funds. Current estimates place Relay’s exposure at close to $48 million and THORChain’s at $44 million.
Reports indicate the cryptocurrency sector has managed to freeze approximately $3 billion in total stolen assets. The Federal Bureau of Investigation attributes the operation to TraderTraitor, a hacking collective allegedly backed by North Korea that is known for converting pilfered assets into Ether. North Korean official Kim Yo Jong publicly rejected the FBI’s allegations, referring to them as “an absurd rhetoric and nothing new” in a statement on November 2.
Binance, currently one of the world’s largest cryptocurrency exchanges, stated it has used company reserves to reimburse about 95% of impacted users, emphasizing that XRP balances on its platform remain fully backed.
