Key takeaways
- Binance hack-linked wallet moves 80 million XRP in seconds
- Two transfers send $101 million to unidentified addresses
- Stolen XRP movements resume as Binance restores customer withdrawals
A cryptocurrency wallet linked to Binance's $6.3 billion security breach transferred 80 million XRP worth approximately $100.9 million to two unidentified addresses on November 2, marking the first major movement of stolen XRP tracked at the address since the October 29 attack.
Blockchain monitoring service Whale Alert recorded the second transfer at 03:56:21 UTC, exactly 50 seconds after another 40 million XRP left the same wallet. Each transaction was valued at approximately $50.5 million.
The transfers came just a day after Binance resumed cryptocurrency withdrawals and reported replacing about 95% of the assets affected by the attack. Neither recipient has been publicly identified, and there is no confirmed evidence that the transferred XRP was sold.
Binance Hack Wallet Splits $101 Million in XRP
Both transactions originated from the XRP Ledger address rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx, labeled "Binance Hack 2026" by Whale Alert.
The first transfer occurred at 03:55:31 UTC, moving 40 million XRP worth approximately $50.44 million. The second followed at 03:56:21 UTC, sending another 40 million XRP to a different address.
The sender previously received 233.46 million XRP, worth roughly $296 million at the time, during the initial Binance security breach.
According to TRM Labs, five Binance wallets transferred those tokens to the same destination between 20:05 and 20:09 UTC on October 29.
The newly highlighted 80 million XRP represented approximately 34.3% of that original balance. Additional transfers also appeared in subsequent blockchain-monitoring records, meaning the two transactions should not be treated as the wallet's entire November 2 activity.
Why Ripple Cannot Freeze the Stolen XRP
The latest movements highlight a significant difference between XRP and Ripple's dollar-backed stablecoin, RLUSD.
After the attack, Ripple froze approximately $40.5 million in stolen RLUSD on Ethereum, preventing the affected tokens from being transferred further.
Native XRP does not have comparable issuer-controlled freezing functionality. Ripple cannot unilaterally block an XRP address or reverse a valid XRP Ledger transaction.
That makes cooperation from exchanges and blockchain-monitoring companies especially important when investigators attempt to recover stolen XRP.
The broader breach also affected cryptocurrency markets. Bitcoin fell below $77,000 during the initial selloff, while BNB dropped more than 8% as investors reacted to the exchange's security problems.
However, the November 2 XRP transfers do not establish a fresh market selloff. Blockchain movements between unidentified wallets can represent redistribution or preparation for further transfers without necessarily involving an exchange transaction.
Binance Restores Withdrawals as Stolen Funds Keep Moving
Binance began reopening withdrawals on November 1 after completing additional security checks across several blockchain networks.
The reopening triggered $3.64 billion in net customer outflows during the first nine and a half hours, despite the exchange's efforts to replenish affected assets.
Binance said approximately 95% of stolen assets had been replaced, improving on its earlier 90% replenishment milestone.
Meanwhile, U.S. authorities have attributed the broader attack to North Korean hackers, with the FBI investigation drawing additional attention to stolen cryptocurrency movements across multiple networks.
