The hacker behind Binance's roughly $6.3 billion hack moved all 233.46 million stolen XRP into six new wallets on Monday. The redistribution underscores a key difference between the assets taken in the breach: unlike the stablecoins also stolen, native XRP has no issuer with the power to freeze it.

According to the XRP Ledger records, the holding address made six test payments of 1,000 XRP each starting at 03:47 UTC. The test transfers preceded the first large payment by about five minutes; small preliminary payments of this kind are commonly used to confirm that a destination address can receive funds. Between 03:52 and 04:00 UTC, nine large payments followed. In the end, five wallets received about 40 million XRP each, three of them in two installments of 30 million and 10 million, while the sixth took 33.46 million. The original address retained 23.7 XRP.

At Monday's price of about $1.26 per XRP, the coins were worth roughly $294 million. Whale Alert spotlighted a single transfer of 40 million XRP, valued at around $50.4 million, from an address it labels as "Binance Hack 2026."

The attacker also sent 1,000 XRP to a seventh, separate address at 02:12 UTC. The coins had sat relatively untouched in the holding address for around 80 hours before the large payments began. Five Binance wallets had sent the entire 233.46 million XRP to that address in about four minutes on October 29. Ledger data at 07:27 UTC on Tuesday showed none of the six new wallets had moved anything out. Because the ledger is public, any onward movement from those addresses will be visible as it happens.

Why the stolen XRP cannot be frozen

Per the XRP Ledger documentation, native XRP cannot be frozen on the ledger. Ripple froze stolen RLUSD tied to the breach, but those issuer controls extend only to its own stablecoin: freeze powers attach to tokens an issuer creates, and the ledger's native asset has no issuer to wield them. The task now is to trace the six wallets and for exchanges to reject deposits to recover the XRP. The split appears to be a laundering step: six balances mean more trails to follow and smaller lots to cash out.

On-chain tracker Lookonchain said around $250,000 of the plunder was moved to the exchange Gate in deposits spread over 12 hours.

Wider fallout from the breach

The attack resulted in about $628 million in assets being stolen on Tron. Tether froze around 378.7 million USDT — the same issuer-level power Ripple used on RLUSD, and one that native XRP lacks — but analyst SomaXBT estimates that about $242 million slipped out through Tron-linked routes in two days. Some $140 million of that passed through services such as Relay and THORChain, whose node operators were asked by the FBI to block the funds. Estimates put Relay's volume at almost $48 million and THORChain's at $44 million.

Cryptopolitan reported that the industry has frozen around $3 billion of the stolen assets. The FBI blames TraderTraitor, its name for a state-linked North Korean hacking operation, saying the attackers are turning stolen crypto into Ether. However, North Korea's Kim Yo Jong denied the FBI's accusation, calling it "an absurd rhetoric and nothing new," in an official statement released November 2.

Binance said company funds have compensated about 95% of the amount affected, and the exchange added that it has full backing for its XRP balances.