Ripple has frozen approximately $200 million in RLUSD holdings connected to a potential exploit on Binance, the company's Senior Vice President of Stablecoins, Jack McDonald, confirmed on October 29. The unauthorized transfers, estimated at roughly $6.3 billion, would make the incident the largest crypto theft on record.
In a post on X, McDonald said Ripple was "closely monitoring reports of a potential exploit involving Binance and its attackers' RLUSD holdings." He added that the company is coordinating with relevant parties and stands ready to support any investigation to protect users.
Issuers Move to Block Stolen Funds
According to the source material, large unauthorized transfers left Binance-linked hot wallets on October 29, 2026, with the total impact estimated at about $6.3 billion — surpassing the $1.5 billion Bybit hack in 2025. Binance attributed the breach to a compromised DevOps engineer's laptop and said there was no evidence of a private-key leak.
Stablecoin issuers acted almost immediately in coordination:
- Tether froze roughly $1.57 billion in USDT.
- Circle locked more than $800 million in USDC.
- Ripple froze approximately $200 million in RLUSD.
Binance co-CEO Yi He publicly acknowledged Ripple's action on X, stating that user funds remain SAFU and that the exchange will cover all losses through the SAFU fund and company reserves. Binance founder CZ also acknowledged the issuer freezes on X.
Freeze Capability Framed as Institutional Feature
Unlike fully decentralized assets such as ETH or BTC, which no issuer can freeze, RLUSD's built-in freeze function is described as a deliberate institutional design choice. According to the source, it limited attackers' exit options and narrowed the window for converting stolen holdings into untraceable assets on decentralized exchanges such as Uniswap.
The incident also highlighted RLUSD's institutional relationships. Ripple recently secured final OCC approval to operate a national trust bank, a regulatory milestone underpinning the stablecoin's compliance architecture. Standard Chartered subsequently launched institutional custody for RLUSD through its DIFC branch, and Robinhood partnered with Ripple to expand adoption across its platform.
Weeks before the incident, Binance itself had expanded support for RLUSD through XRP rewards campaigns, helping push the stablecoin's market cap past $2.4 billion. That same relationship meant Binance held meaningful RLUSD balances, which is why the freeze carried weight.
Withdrawals Expected to Resume
Binance has said withdrawal services are expected to resume within 48 hours, with a full post-mortem and proof of reserves to follow remediation. The exchange's initial investigation found no private keys were compromised, and Binance has guaranteed full coverage of user funds.
