Introduction

The attacker behind the reported $6.3 billion Binance security breach has moved approximately 233.46 million XRP, worth around $293 million, into six newly created wallets, according to blockchain transaction tracking reported by Bitcoin.com News.

The transfers occurred between 03:52 and 04:00 UTC on November 2, ending an approximately 80-hour period during which the stolen XRP remained untouched.

The latest movements have raised concerns about potential money laundering and efforts to move stolen cryptocurrency beyond the reach of exchanges and investigators.

Key Highlights

  • 233.46 million XRP worth approximately $293 million moved into six new wallets.

  • The transfers occurred within eight minutes on November 2.

  • Five wallets received approximately 40 million XRP each; the sixth received 33.46 million XRP.

  • Around $242 million in stolen assets reportedly moved through Tron-related routes.

  • Tether previously froze approximately 378.7 million USDT linked to the incident.

  • Binance says it has covered approximately 95% of the reported stolen assets.

Six Wallets Receive the Stolen XRP

According to Bitcoin.com News, the attacker-controlled XRP Ledger address first sent small test transactions to six new wallets before transferring the larger amounts.

Blockchain tracker Whale Alert flagged two separate transfers of 40 million XRP, each worth approximately $50.4 million at the time.

The full transaction history showed nine large payments totaling approximately 233.45 million XRP. Five receiving wallets held around 40 million XRP each, while the sixth received 33.46 million XRP.

As of 04:37 UTC on November 2, none of the six receiving wallets had transferred the funds onward.

The XRP was originally taken from five Binance wallets on October 29. TRM Labs traced the initial transfers to a single attacker-controlled address within approximately four minutes. <Cite refs={["turn275160view0","turn275160view1"]}/>

Why the XRP Cannot Be Frozen

Unlike certain stablecoins, native XRP does not have a central issuer with the ability to freeze tokens at specific wallet addresses.

Ripple previously froze approximately $40.5 million in stolen RLUSD on Ethereum. However, those issuer-level controls do not apply to XRP.

Consequently, recovery efforts depend on blockchain monitoring, identifying suspicious transactions and cooperation from cryptocurrency exchanges that may receive the funds.

Bitcoin.com News reported that splitting the XRP across multiple wallets could be part of an attempt to complicate tracking or prepare the funds for further movement. This remains an assessment rather than confirmation that the assets have been successfully laundered. <Cite refs={["turn275160view0","turn275160view1"]}/>

$242 Million Moves Through Tron-Related Routes

The XRP transfers are part of a wider effort to move assets connected to the Binance incident.

Bitcoin.com News reported that approximately $242 million in stolen assets had moved through Tron-related routes. The report also said Tether froze around 378.7 million USDT, after which funds were routed through services including Relay, THORChain, Chainflip and Symbiosis.

Another reported $41.7 million moved through Bitget Wallet, with its final destination still unconfirmed.

The attacker also reportedly deposited approximately $250,000 into the centralized exchange Gate, suggesting that investigators are monitoring possible exchange-based exit routes. <Cite refs={["turn275160view0"]}/>

What Happens Next?

Investigators and exchanges will be watching the six new XRP wallets for further transfers or deposits into centralized trading platforms.

The broader investigation will also focus on tracing the remaining stolen assets and identifying whether additional funds can be frozen or recovered.

Binance has stated that it has covered approximately 95% of the affected amount using company resources and protection funds. US authorities have attributed the theft to North Korea, according to the report. <Cite refs={["turn275160view0","turn109277news3"]}/>

Final Takeaway

The movement of $293 million in stolen XRP shows that the Binance security incident remains an active concern even after the exchange's recovery efforts.

Although the funds have been divided among six new wallets, there is no confirmation that the XRP has been sold or successfully converted into other assets.

The next movements will be important for blockchain investigators and exchanges monitoring the stolen funds.