The Binance hack victim address on the XRP Ledger began sending test payments of 1,000 XRP to six new wallets at 03:47 UTC on November 2. Within minutes, the attacker transferred the remaining balance of 233.46 million XRP, valued at roughly $293 million, across those wallets.
Details of the transfers
Blockchain tracker Whale Alert recorded two consecutive transfers of 40 million XRP each, followed by additional payments that together amounted to the full balance. Five of the receiving wallets now hold about 40 million XRP each, while the sixth holds 33.46 million XRP. As of 04:37 UTC, none of the six wallets had moved the funds onward.
Why the XRP could not be frozen
Unlike stablecoins, native XRP lacks an issuer with freeze authority, so the assets remain on‑chain unless exchanges voluntarily block deposits. Ripple was able to freeze related stablecoin tokens, but those controls do not apply to XRP itself.
Related activity on Tron
Analysts reported that approximately $242 million of the stolen assets had already been moved through Tron‑related routes, including Relay, Thorchain, Chainflip and Symbiosis, after Tether froze about 378.7 million USDT. Additional funds passed through a Bitget wallet, though the final destination remains unknown.
Testing exits on centralized exchanges
On‑chain analytics firm Lookonchain observed a deposit of $250,000 into the Gate exchange over a 12‑hour period, indicating the attacker is probing custodial platforms for potential exits.
Response and attribution
U.S. authorities have linked the theft to North Korea. Binance has stated it has covered roughly 95 % of the affected amount with its own funds.
