Crypto commentator Digital Asset Investor (@digitalassetbuy) raised an alert after 233 million stolen XRP began moving across the blockchain.
The funds, taken during the October 29 Binance hack, were split across six fresh addresses. He identified this as a pattern analysts associate with money laundering preparation.
How the Binance Hack Unfolded
Early reports suggested XRP had no involvement in the Binance breach. Further investigation told a different story. The XRP theft did not follow the hack, it started it.
Between 20:05 and 20:09 UTC on October 29, five Binance wallets transferred 233.46 million XRP to a single attacker-controlled address. The entire transfer was completed in four minutes. From there, the attack spread across nine more blockchains, including Bitcoin, Ethereum, Tron, and Solana.
By the time investigators compiled the full picture, total losses reached approximately $6.36 billion, making it the largest cryptocurrency theft in history. The XRP alone accounted for roughly $296 million, or about 4.7% of the total stolen.
233 Million Stolen XRP On The Move pic.twitter.com/Ca2XOlK2eq
— Digital Asset Investor (@digitalassetbuy) November 2, 2026
The Scale of the Attack
The attack hit ten blockchains in under 20 minutes. Tron losses totaled around $628 million. Solana lost approximately $96 million. The largest share came from Bitcoin and Ethereum holdings.
Blockchain analytics firms TRM Labs, Chainalysis, and Nansen all confirmed the XRP transfers as part of the same coordinated operation. The $296 million in XRP is now included in all major estimates of the total theft, and is much more than the 103 million XRP ($158 million) stolen from Bitget less than a month earlier.
Binance pledged to cover all losses from its own funds, setting aside $6.34 billion to compensate affected users.
Stolen XRP On the Move
For roughly 80 hours after the theft, the stolen XRP remained untouched in its single destination wallet. Investigators monitored the address closely. No outgoing transactions appeared during that window.
Then on November 2, the attacker moved. Nine transfers between 3:52 and 4:00 UTC redistributed approximately 233.45 million XRP across six newly created wallets. Digital Asset Investor flagged the movement, noting the split is a recognized step in laundering operations.
XRP cannot be frozen at the protocol level, which limits the options available to authorities and exchanges. Ripple did freeze $40.5 million in RLUSD connected to the hack, but native XRP does not carry that capability.
Where Things Stand
As of November 3, the six wallets holding the stolen XRP have not sent funds onward. Investigators continue to monitor the addresses. The movement signals the attacker is preparing next steps, though no exchange has reported receiving the funds.
Disclaimer: This content is meant to inform and should not be considered financial advice. The views expressed in this article may include the author’s personal opinions and do not represent Times Tabloid’s opinion. Readers are advised to conduct thorough research before making any investment decisions. Any action taken by the reader is strictly at their own risk. Times Tabloid is not responsible for any financial losses.
Follow us on X, Facebook, Telegram, and Google News
