XRP Targeted First in Binance Breach: Five Wallets Depleted in Approximately Four Minutes

Five Payments Consolidated $296 Million

Binance lost approximately $296 million in XRP on Oct. 29, TRM Labs’ transaction tracing found. The blockchain intelligence firm investigates illicit cryptocurrency activity. It stated:

“The first theft of the night came on the XRP Ledger. Between 20:05 and 20:09 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address, leaving each wallet with only its minimum balance.”

Onchain analytics firm Glassnode reported the same order, posting on X: “XRP went first, then SOL shortly after, then BTC, ETH, USDT and TRX.” Blockchain analytics platform Arkham placed the attacker’s first $300 million on XRP, ahead of $6 billion moved across 141 transfers on nine chains between 20:10 and 23:05 UTC.

Xrplwin, an explorer displaying XRP Ledger transactions and account activity, traced five transfers into one attacker-controlled address over four minutes and 20 seconds. The opening transfer accounted for approximately 79% of the total. Each wallet retained its required account reserve, XRP that cannot be sent through ordinary payments. Investigators can follow subsequent transfers through public wallet balances and transaction histories.

Ripple Restricted RLUSD as Binance Investigated Its Breach

The exchange’s initial findings on the wallet breach described unauthorized withdrawals from Binance-controlled wallets. Describing the wider attack, TRM stated:

“Within minutes, Binance wallets on the XRP Ledger, Ethereum, Bitcoin, Tron, Solana and four other networks had sent their balances to addresses controlled by a single attacker.”

Co-CEO Richard Teng subsequently disclosed additional breach points and bypassed approval controls as investigators expanded their review. TRM identified ordinary signed XRP transfers from Binance wallets. Its assessment pointed to compromised signing access across networks.

Ripple froze 40.5 million stolen RLUSD, its dollar-backed stablecoin, on Ethereum at 10:01 p.m. UTC on Oct. 29, TRM confirmed. The attacker had sold 48 million of the 88.5 million RLUSD stolen. Ripple also restricted RLUSD in the compromised Binance wallet to prevent further sweeps.

Issuer freeze controls allow a stablecoin provider to block its tokens’ transfers at specified addresses. Blockchain analytics firm Elliptic’s tracking of the stolen XRP found those tokens unmoved as of 5 a.m. UTC on Oct. 31. RLUSD’s issuer controls do not apply to XRP; recovery efforts depend on tracing and potential interception by exchanges or other services.

Binance Said XRP Balances Were Fully Backed

More than $6.34 billion was reserved under Binance’s commitment to absorb the financial losses, the exchange said on Oct. 30. Binance pledged coverage through its user protection fund and corporate treasury.

Under its withdrawal restoration and recovery plan, Binance linked reopening to security checks and validation of affected systems. The exchange maintained its Nov. 1 reopening target in its Oct. 31 update.

In its Oct. 31 update on backing for XRP and nine other cryptocurrencies, Binance stated: “All BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC are fully backed 100%.” It reported 90% replenishment overall.

A published Oct. 31 reserve snapshot recorded holdings and customer balances at that time. Zero-knowledge proofs let users verify inclusion of their balances in reported totals without exposing other customers’ details. Binance expected its full proof for the ten assets by Nov. 3.