Key Takeaways
- The Binance hacker split 233.46M XRP across six fresh wallets between 03:52 and 04:00 UTC on Nov. 2.
- Trackers say about $242M already moved through Tron routes after Tether froze 378.7M USDT.
- Over $3B in stolen assets remains largely untouched, so exchanges are watching the six XRP wallets.
The Stolen XRP Wakes up
The attacker’s holding address on the XRP Ledger (XRPL) started sending test payments of 1,000 XRP to six new wallets at 03:47 UTC on Nov. 2. The large transfers came a few minutes later.
Blockchain tracker Whale Alert flagged a transfer of 40 million XRP, worth about $50.4 million, from an address labelled as “Binance Hack 2026.” Less than a minute later, it flagged a second 40 million XRP transfer of the same size.
Those two alerts were only part of the move, as the wallet’s full ledger history shows nine large payments between 03:52 and 04:00 UTC, totaling about 233.45 million XRP. After the six test transfers, the address held just 23.7 XRP.
Five of the receiving wallets now hold about 40 million XRP each. The sixth wallet holds 33.46 million XRP. As of 04:37 UTC, none of the six had sent funds onward.
This is the stash Bitcoin.com News covered when XRP was hit first in the Oct. 29 attack. Starting at 20:05 UTC, five Binance wallets sent 233.46 million XRP to a single attacker address in about four minutes.
With XRP trading near $1.26, the haul is now worth about $293 million.
Why the XRP Was Never Frozen
Unlike stablecoins, native XRP has no issuer that can freeze it. Ripple froze stolen RLUSD linked to the attack, but those issuer freeze controls don’t apply to XRP, and getting the XRP back depends on tracing it and on exchanges blocking deposits.
Blockchain analytics firm Elliptic had found the XRP was in place as of Oct. 31, so this latest splitting of a large balance across several new wallets is likely a laundering step. It creates more trails for investigators to follow and lets the funds move in smaller amounts.
$242 Million Already Moved Through Tron
The XRP move comes alongside new tracing data from another chain. Analysts reported that the attacker moved about $242 million through Tron-related paths within two days of the hack. About $628 million in assets on Tron was stolen in the attack.
The report said that after Tether froze about 378.7 million USDT, the attacker moved funds through Relay, Thorchain, Chainflip, Symbiosis and other channels. Another $41.7 million went through Bitget Wallet, and its destination is still unconfirmed.
Thorchain, a cross-chain swap protocol, was one of the main routes. A network glitch halted it as the FBI pressed node operators to block transactions linked to the hack. The bitcoin portion also hasn’t moved.
Lastly, Bitcoin.com News reported recently that North Korea’s $1.4B bitcoin haul also remains in place at the time of writing.
A Trickle Into Gate
The attacker is also probing centralized exchanges and onchain analytics account Lookonchain said the hacker deposited $250,000 into crypto exchange Gate over 12 hours. And while that is a tiny sum next to the overall haul, it shows the hacker is testing exits that run through custodial platforms.
The timing, however, is awkward for Gate, as its chief executive called for a security alliance across the industry days after the breach. Gate hadn’t commented publicly on the deposits at the time of writing.
U.S. authorities have attributed the theft to North Korea. Binance says it has covered about 95% of the affected amount with company funds. Interesting few days ahead!
