Binance experienced a significant wallet breach on October 29 involving approximately $296 million in XRP transfers across multiple blockchain networks. Blockchain intelligence firm TRM Labs documented the attack through transaction tracing and on-chain analysis.
Five Binance wallets transferred 233.46 million XRP to a single attacker address between 20:05 and 20:09 UTC, each wallet retaining only its minimum required balance. According to TRM Labs, the first theft occurred on the XRP Ledger before the attacker moved to other networks. Analytics firm Glassnode reported the sequence as XRP first, followed by SOL, BTC, ETH, USDT, and TRX. The opening XRP transfer accounted for approximately 79% of the initial theft.
The broader attack moved more than $6 billion across 141 transfers on nine blockchain networks between 20:10 and 23:05 UTC. TRM Labs identified ordinary signed XRP transfers from Binance wallets, pointing to compromised signing access across multiple networks.
Ripple Response and Stablecoin Freeze
Ripple froze 40.5 million RLUSD, its dollar-backed stablecoin, on Ethereum at 10:01 p.m. UTC on October 29. The attacker had sold 48 million of the 88.5 million RLUSD stolen. Ripple also restricted RLUSD in the compromised Binance wallet to prevent further transfers. Unlike RLUSD, XRP lacks issuer freeze controls, so recovery efforts depend on tracing and potential interception by exchanges.
Blockchain analytics firm Elliptic confirmed that stolen XRP tokens remained unmoved as of 5 a.m. UTC on October 31.
Binance's Recovery Commitment
Binance pledged more than $6.34 billion to cover financial losses through its user protection fund and corporate treasury. In its October 31 update, the exchange stated that BTC, ETH, USDT, BNB, SOL, USDC, XRP, USD1, RLUSD, and ZEC were fully backed at 100%. The exchange reported 90% replenishment overall.
Binance linked service restoration to security checks and system validation, maintaining its November 1 reopening target. A published reserve snapshot from October 31 recorded holdings and customer balances at that time, with the exchange expected to provide zero-knowledge proofs for all ten affected assets by November 3, allowing users to verify balance inclusion without exposing other customers' details.
