Binance Hack: XRP Hit First as Five Wallets Drained in About Four Minutes

Binance Multi-Chain Exploit Traced Across Major Networks

An extensive security breach targeting cryptocurrency exchange Binance resulted in unauthorized multi-network asset sweeps, according to tracking data and forensic analysis. Explorer platform Xrplwin, which monitors transactions and activity on the XRP Ledger, revealed that the attacker funneled funds into a single recipient address through five separate transfers completed in four minutes and 20 seconds. The initial transaction alone represented approximately 79% of the total XRP stolen. The affected accounts retained only their mandatory base account reserves, which constitute the minimum XRP balance required by the network that cannot be liquidated through regular payment channels.

The unauthorized movement was not isolated to a single blockchain. Blockchain intelligence firm TRM analyzed the broader scope of the incident, observing rapid, synchronized asset drains. Describing the wider attack, TRM stated:

“Within minutes, Binance wallets on the $XRP Ledger, Ethereum, Bitcoin, Tron, Solana and four other networks had sent their balances to addresses controlled by a single attacker.”

Binance Co-CEO Richard Teng confirmed that the breach bypassed internal approval controls and exposed multiple compromise points. TRM identified ordinary signed XRP transfers originating directly from Binance-controlled wallets, signaling compromised signing access across multiple blockchain ecosystems.

Ripple Implements RLUSD Freeze as Elliptic Tracks Stolen XRP

In response to the exploit, Ripple moved quickly to mitigate losses involving its dollar-backed stablecoin, RLUSD. TRM confirmed that Ripple froze 40.5 million stolen RLUSD on Ethereum at 10:01 p.m. UTC on October 29. Prior to the freeze, the perpetrator managed to liquidate 48 million of the 88.5 million stolen RLUSD tokens. Alongside the token freeze, Ripple placed restrictions on RLUSD held in the compromised Binance wallet to halt subsequent sweep attempts.

Centralized stablecoin architectures often feature issuer-level freeze functionality, allowing the issuing entity to blacklist specific smart contract addresses and halt transfers. However, these programmatic controls are exclusive to the stablecoin contracts and do not apply to native blockchain tokens such as XRP. According to blockchain analytics firm Elliptic, the illicitly acquired XRP remained unmoved as of 5:00 a.m. UTC on October 31. Because native XRP lacks central issuer controls, retrieval remains reliant on public ledger surveillance and coordination with external exchanges to intercept funds if they are deposited.

Binance Pledges $6.34 Billion Reserve to Cover Customer Losses

Addressing the fallout from the exploit, Binance announced on October 30 that it allocated more than $6.34 billion from its corporate treasury and user protection fund to fully absorb the impact of the stolen assets. The exchange tied its timeline for restoring withdrawals directly to comprehensive security checks and technical validation across compromised infrastructures, maintaining an operational target to resume activity by November 1.

In an update issued on October 31 regarding its balance sheets, Binance reaffirmed that asset reserves remain intact despite the incident. Binance stated: “All $BTC, $ETH, $USDT, BNB, $SOL, USDC, $XRP, USD1, $RLUSD, and ZEC are fully backed 100%.” The exchange confirmed that replenishment had already reached 90% across all affected pools.

To assure customers of solvency, Binance published an October 31 reserve snapshot showing its live asset balances alongside customer liabilities. The exchange employs zero-knowledge cryptographic proofs, enabling platform users to verify that their personal account balances are accounted for in total reserve audits without compromising individual privacy. Binance stated it expects to provide full cryptographic proofs covering all ten impacted assets by November 3.

Why This Matters

This incident underscores the persistent structural vulnerabilities surrounding private key management and automated signing infrastructure at centralized exchanges. While programmatic issuer controls enabled Ripple to freeze tens of millions of dollars in RLUSD on Ethereum, native ledger assets like XRP cannot be administratively halted, demonstrating the fundamental operational differences between centralized stablecoins and base-layer crypto assets. Binance’s reliance on a multi-billion-dollar backstop and zero-knowledge proof verification highlights the growing industry reliance on corporate balance sheets and public cryptographic auditing to maintain market confidence during major security breaches.

Frequently Asked Questions

How much RLUSD was affected and recovered?

The exploiter stole a total of 88.5 million RLUSD and liquidated 48 million tokens before intervention occurred. Ripple successfully froze the remaining 40.5 million RLUSD on the Ethereum network and placed restrictions on the targeted Binance wallet to prevent further withdrawals.

Were customer XRP balances lost in the Binance hack?

Binance reported that all customer funds remain 100% backed, committing over $6.34 billion from its corporate treasury and user protection fund to absorb the shortfall. As of October 31, the exchange achieved a 90% total replenishment rate across affected digital assets.

Can the stolen XRP be frozen like RLUSD?

No. While stablecoins like RLUSD feature smart contract blacklist and freeze functions managed by the issuer, native XRP operates on a decentralized ledger without administrative freeze controls. Recovering stolen XRP relies on forensic tracking and interception by custodial services and exchanges if the attacker attempts to off-ramp the funds.