Stolen XRP Totaling 233 Million Transferred Across Wallets

Cryptocurrency commentator Digital Asset Investor (@digitalassetbuy) raised an alert after 233 million stolen XRP began moving across the blockchain.

The funds, taken during the October 29 Binance hack, were distributed across six fresh addresses. He identified this as a pattern analysts associate with money laundering preparation.

How the Binance Hack Unfolded

Early reports suggested XRP had no involvement in the Binance breach. Further investigation revealed a different story. The XRP theft did not follow the hack; rather, it started it.

Between 20:05 and 20:09 UTC on October 29, five Binance wallets transferred 233.46 million XRP to a single attacker-controlled address. The entire transfer wrapped up in four minutes. From there, the attack branched out across nine more blockchains, including Bitcoin, Ethereum, Tron, and Solana.

By the time investigators pieced together the full picture, total losses reached approximately $6.36 billion, making it the largest cryptocurrency theft in history. The XRP alone accounted for roughly $296 million, representing about 4.7% of the total loot.

233 Million Stolen XRP On The Move

— Digital Asset Investor (@digitalassetbuy) November 2, 2026

The Scale of the Attack

The attack struck ten blockchains in under 20 minutes. Tron losses came in around $628 million, while Solana lost approximately $96 million. The largest share originated from Bitcoin and Ethereum holdings.

Blockchain analytics firms TRM Labs, Chainalysis, and Nansen all confirmed the XRP transfers were part of the same coordinated operation. The $296 million in XRP is now factored into all major estimates of the total theft, dwarfing the 103 million XRP ($158 million) stolen from Bitget less than a month prior.

Binance promised to cover all losses using its own reserves, setting aside $6.34 billion to reimburse affected users.

Stolen XRP On the Move

For about 80 hours following the theft, the stolen XRP sat untouched in its single destination wallet. Investigators kept a close eye on the address, noting a complete absence of outgoing transactions during that window.

Then, on November 2, the attacker made their move. Nine transfers between 3:52 and 4:00 UTC redistributed roughly 233.45 million XRP to six newly generated wallets. Digital Asset Investor highlighted the activity, pointing out that splitting funds is a known preliminary step in laundering schemes.

XRP cannot be frozen at the protocol level, which restricts the options available to law enforcement and exchanges. Although Ripple managed to freeze $40.5 million in RLUSD linked to the incident, native XRP lacks that built-in capability.

Where Things Stand

As of November 3, the six wallets holding the stolen XRP have not transferred the funds any further. Investigators continue tracking the addresses. This movement indicates the attacker is readying their next moves, though no exchange has reported receiving the assets so far.

Frequently Asked Questions

How much stolen XRP was recently moved?

Approximately 233 million stolen XRP, taken during the October 29 Binance hack, began moving across the blockchain and was split across six new addresses.

How much was the total loss from the Binance hack?

Total losses reached approximately $6.36 billion, making it the largest cryptocurrency theft in history, with the XRP portion accounting for roughly $296 million.

Can native XRP be frozen by authorities or exchanges?

No, XRP cannot be frozen at the protocol level, though Ripple successfully froze $40.5 million in RLUSD connected to the same hack.

What blockchains were affected by the attack?

The attack impacted ten blockchains in under 20 minutes, including Bitcoin, Ethereum, Tron, and Solana.