XRP was first asset drained in Binance breach, tracing shows

What happened

XRP was the first asset to leave Binance-controlled wallets in the exchange's Oct. 29 breach, according to transaction tracing by blockchain intelligence firm TRM Labs cited by Bitcoin.com News. Five Binance wallets on the XRP Ledger sent 233.46 million XRP to a single attacker address between 20:05 and 20:09 UTC, each left holding only its minimum balance.

The XRP Ledger explorer Xrplwin traced the five transfers into one attacker-controlled address over four minutes and 20 seconds, with the opening transfer accounting for roughly 79% of the total. Each wallet retained its required account reserve, a balance that cannot be moved through ordinary payments. TRM estimated the XRP loss at about $296 million, while Arkham placed the attacker's first $300 million on XRP ahead of roughly $6 billion moved across 141 transfers on nine chains between 20:10 and 23:05 UTC.

Glassnode reported the same sequence, writing that XRP went first, followed shortly by SOL, then BTC, ETH, USDT and TRX. TRM said wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and four other networks had sent their balances to addresses controlled by a single attacker within minutes, and characterized the XRP movements as ordinary signed transfers, an assessment pointing to compromised signing access across networks.

On Nov. 2, Whale Alert flagged two transfers of 40 million XRP each from an address tagged "Binance Hack 2026," valued at about $50.46 million and $50.44 million. The transfers left at 03:56 UTC and 50 seconds earlier, going to separate unidentified addresses, U.Today reported. There was no indication at the time that the funds had reached an exchange or been sold.

Why it matters

The episode put XRP at the centre of the breach's first outflow, but the recovery options differ by token. Ripple, issuer of the dollar-backed stablecoin RLUSD, froze 40.5 million stolen RLUSD on Ethereum at 22:01 UTC on Oct. 29, TRM confirmed, and restricted RLUSD held in the compromised Binance wallet. Issuer freeze controls let a stablecoin provider block transfers at specified addresses; they do not extend to XRP, so recovery of the XRP depends on tracing and possible interception by exchanges and other services. Elliptic's tracking found the stolen XRP unmoved as of 05:00 UTC on Oct. 31.

What the data shows

TRM's figure of about $296 million covers the XRP tranche alone. The attacker took 88.5 million RLUSD and had sold 48 million of it before Ripple's freeze, according to TRM. Binance said more than $6.34 billion was reserved to absorb losses, drawn from its user protection fund and corporate treasury. In its Oct. 31 update the exchange said BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD and ZEC were "fully backed 100%" and reported 90% replenishment overall. U.Today reported Binance later put replenishment at about 95% as of Nov. 1, with the remainder mostly less liquid assets.

Background

Binance's initial findings described unauthorized withdrawals from wallets it controlled. Co-CEO Richard Teng later disclosed additional breach points and approval controls that had been bypassed as the review widened. The exchange paused withdrawals after the Oct. 29 incident and said on Nov. 1 that it would restore them in phases across 15 networks including XRP Ledger, Bitcoin, Ethereum, BNB Smart Chain and Solana, with the first stage scheduled between 06:00 and 09:00 UTC that day, followed by networks such as Tron, Dogecoin, Zcash, Avalanche, Sui, Polygon and Arbitrum. Reopening was tied to security checks and validation of affected systems, with Nov. 1 kept as the target in the Oct. 31 update.

What to watch

Two threads remain open. The first is what happens to the roughly 233 million XRP attributed to the attacker and to the 80 million XRP moved on Nov. 2, which had not been traced to a sale or deposit. The second is verification: Binance published an Oct. 31 reserve snapshot and said it expected a full proof of reserves for the ten assets by Nov. 3, using zero-knowledge proofs that let users confirm their balances are included without exposing other customers' details. Bitcoin.com News also noted that claims the breach was an inside job were spreading on X.

Questions readers ask