Key Takeaways
- Binance’s $6.3 billion security breach began when five XRP Ledger wallets transferred approximately 233.46 million XRP, valued at $296 million.
- The XRP transfers occurred between 20:05 and 20:09 UTC on Oct. 29, before the largest Bitcoin and Ethereum withdrawals.
- Blockchain investigators found the stolen XRP sitting in an attacker-controlled address, with no outgoing transfers identified in their early Oct. 30 snapshot.
Binance’s record-breaking $6.3 billion security breach did not begin with Bitcoin or Ethereum.
The first major withdrawals identified by investigators occurred on the XRP Ledger, where approximately 233.46 million XRP, worth $296 million, left five Binance wallets within four minutes.
According to blockchain intelligence firm TRM Labs, the XRP transfers began around 20:05 UTC on Oct. 29, roughly 15 minutes before the attacker executed some of the largest withdrawals on Bitcoin and Ethereum.
The stolen XRP was sent to a single attacker-controlled address, according to the firm’s investigation.
By early Oct. 30, the funds had not moved again, based on Bitquery’s onchain tracing.
The incident raises questions about how an attacker obtained authorization to move assets across several blockchain networks and whether the stolen XRP can be recovered.
How Binance’s $6.3B Hack Started With 233.5M XRP
TRM Labs traced approximately 233.46 million XRP leaving five Binance-controlled wallets between 20:05 and 20:09 UTC. The transfers preceded the movement of 18,270 BTC at approximately 20:20 UTC, followed by a major Ethereum wallet drain minutes later.
By the end of the attack, TRM had identified roughly $6.36 billion in unauthorized transfers across ten blockchain networks.
The firm also found evidence of preparation beginning at least 36 hours earlier, including test transactions and malicious Ethereum smart-contract deployments.
The XRP withdrawals were especially revealing because the XRP Ledger does not use Ethereum’s EIP-7702 wallet-delegation mechanism.
Instead, the transactions were ordinary signed transfers, suggesting the attacker had gained access to infrastructure capable of authorizing withdrawals across different networks.
Binance’s preliminary investigation points to a compromised DevOps engineer’s laptop that allegedly allowed unauthorized withdrawal instructions to be submitted through an internal service.
The exchange said it had found no evidence of leaked wallet private keys.
Where Did the 233.5M Stolen XRP Go?
Unlike the stolen stablecoins that attackers converted into other cryptocurrencies, the XRP remained in its receiving wallet during the initial investigation.
Bitquery’s Oct. 30 analysis identified the destination as an XRP Ledger address beginning rK21t6 and ending gfzMx.
At 06:43 UTC on Oct. 30, the address still held approximately 233.5 million XRP, with no outgoing transactions identified.
The receiving account had been created less than a minute before the initial transfers, according to Bitquery. The funds had not been traced to an exchange, cross-chain bridge or cryptocurrency mixer at the reporting cutoff.
The stolen XRP accounted for approximately 4.7% of the overall $6.3 billion incident, based on its $296 million valuation at the time of the theft.
Its inactivity could indicate that the attacker was waiting before attempting to move the funds. However, blockchain records cannot establish the attacker’s intentions.
Why Can’t Ripple Simply Freeze the Stolen XRP?
The XRP Ledger supports both its native cryptocurrency, XRP, and issued assets such as RLUSD.
Unlike centrally issued stablecoins, native XRP does not have an issuer-controlled blacklist that can prevent an address from transferring its holdings.
Ripple therefore cannot freeze stolen XRP in the same way a stablecoin issuer can restrict tokens it controls.
The company did intervene elsewhere in the Binance incident.
TRM Labs reported that Ripple froze approximately 40.5 million RLUSD linked to the attack, after another 48 million RLUSD had already been exchanged through decentralized trading platforms.
The XRP stolen from Binance presents a different recovery challenge.
Investigators can monitor its destination address and alert exchanges if the funds begin moving. Recovering the cryptocurrency would likely require cooperation from trading platforms, law enforcement or other parties able to control assets at a later stage.
Binance Promises Full Coverage as XRP Recovery Remains Uncertain
Binance co-CEO Richard Teng said the exchange would cover customer losses using its SAFU emergency fund and corporate resources.
The company also temporarily suspended withdrawals while it reviewed its infrastructure and revoked affected authorizations.
Blockchain intelligence firm TRM Labs attributed the broader attack to North Korea’s TraderTraitor group with high confidence, although Binance has not publicly confirmed who was responsible.
The immediate question for XRP holders is whether the stolen 233.5 million tokens remain untouched. As of Bitquery’s 06:43 UTC snapshot on Oct. 30, the entire amount was still visible at the receiving address.
The XRP Ledger recorded the first major withdrawals of the Binance breach, but the stolen XRP had not disappeared into an untraceable network. It remained in a publicly identifiable wallet, leaving investigators with a clear destination but no confirmed recovery.
The next outgoing transaction could provide the first indication of where the attacker intends to move the funds.
internal-linking title=”Top Trending Crypto Articles” url1=”https://www.ccn.com/crypto-exchanges/” text1=”Check Out Our Recommended Exchanges Here” label1=”Best Exchanges” url2=”https://www.ccn.com/how-to-buy-crypto-with-credit-card/” text2=”How To Buy Crypto with a Credit Card Now” label2=”Buy Crypto Fast” url3=”https://www.ccn.com/crypto-gambling/” text3=”See Our Picks for the Best Crypto Gambling Sites” label3=”Safe Crypto Gambling”]
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
