The XRP stolen in last month's Binance breach has started moving again, with roughly 233 million tokens routed through a series of newly created wallets in what blockchain analysts describe as a possible prelude to laundering.
The funds, valued at about $296 million at the time of the theft, were spread across six fresh addresses in nine transfers executed between 03:52 and 04:00 UTC on November 2, according to on-chain monitoring. The split came roughly 80 hours after the tokens had sat untouched in a single attacker-controlled wallet.
Binance's security failure now ranks as the largest cryptocurrency theft on record. Between 20:05 and 20:09 UTC on October 29, five exchange wallets sent 233.46 million XRP to one address in a four-minute window, and the intrusion then spread to nine additional blockchains, including Bitcoin, Ethereum, Tron and Solana. Investigators put combined losses at about $6.36 billion, of which the XRP accounted for roughly 4.7%.
Tron holdings accounted for about $628 million of the haul and Solana about $96 million, with Bitcoin and Ethereum representing the largest share. TRM Labs, Chainalysis and Nansen have all linked the XRP transfers to the same coordinated operation.
Note: Figures reflect estimates compiled by blockchain analytics firms as of November 3.
Earlier reporting had suggested XRP played no part in the breach. Subsequent tracing showed the opposite: the XRP transfers were the opening move rather than a follow-on theft.
Wallets Go Quiet, Then Disperse
Whale Alert, which tagged the originating XRP Ledger address as "Binance Hack 2026," recorded two transfers about 50 seconds apart on November 2, each moving 40 million XRP worth roughly $50.5 million to separate unidentified destinations. Those two transactions represented about 34.3% of the original balance, and further transfers appeared in later monitoring records, so they did not account for the wallet's full activity that day.
Crypto commentator Digital Asset Investor (@digitalassetbuy) flagged the broader dispersal, noting that the six-way split matches a pattern analysts associate with preparation for money laundering. As of November 3, none of the six wallets had forwarded funds, and no exchange had reported receiving them.
The movement resumed a day after Binance reopened cryptocurrency withdrawals on November 1 and said it had replaced about 95% of the assets affected by the attack, up from an earlier 90% milestone. The exchange has pledged to cover all losses from its own funds and has set aside $6.34 billion for customer compensation. The reopening nonetheless coincided with $3.64 billion in net customer outflows over the first nine and a half hours.
Recovery Limits Shape the Response
Native XRP cannot be frozen at the protocol level, leaving authorities and exchanges with few direct options. Ripple was able to block about $40.5 million in RLUSD, its dollar-backed stablecoin, that had been taken in the breach and was sitting on Ethereum, but it has no equivalent power over the XRP Ledger and cannot unilaterally halt an address or reverse a confirmed transaction. Recovery therefore depends heavily on cooperation from trading venues and analytics providers.
U.S. authorities have attributed the wider attack to North Korean hackers, and the FBI investigation has drawn scrutiny to the movement of stolen coins across multiple networks.
The initial disclosure rattled markets: Bitcoin fell below $77,000 during the selloff that followed, and BNB dropped more than 8%. The November 2 wallet activity has not by itself produced a fresh downturn, since transfers between unidentified addresses can reflect redistribution rather than a sale on an exchange.
For XRP holders, the immediate question is whether the dispersed tokens reach a venue that can identify and flag them. Because the ledger offers no issuer-level kill switch, tracing and exchange-level blocking remain the only practical defenses, and the coming days will show whether the attacker attempts to convert the balance or continues layering it through new addresses.
