On Oct. 29, Binance suffered a multi‑chain wallet breach that resulted in the rapid theft of roughly $296 million worth of XRP, according to blockchain intelligence firm TRM Labs. Five Binance‑controlled XRP Ledger wallets moved a total of 233.46 million XRP to a single attacker address between 20:05 and 20:09 UTC, leaving each wallet with only the required minimum reserve.

Scope of the XRP theft

TRM Labs’ tracing indicates the initial XRP transfer accounted for about 79 % of the total loss, with the remaining four transfers completing within a span of four minutes and twenty seconds. Glassnode corroborated the sequence, noting that XRP was the first asset stolen, followed shortly by SOL, BTC, ETH, USDT and TRX across nine blockchains. Arkham’s data placed the attacker’s first $300 million on XRP before moving $6 billion across other chains later that night.

Ripple’s response and RLUSD freeze

Ripple acted to contain the fallout by freezing $40.5 million of its dollar‑backed stablecoin RLUSD on Ethereum at 22:01 UTC on Oct. 29, as reported by TRM Labs. The freeze prevented further transfers from the compromised Binance wallet, and the issuer’s controls blocked the stolen RLUSD from being moved. Elliptic later observed that the stolen XRP remained unmoved as of 05:00 UTC on Oct. 31, while the RLUSD freeze limited the attacker’s ability to liquidate the stablecoin.

Binance’s remediation and backing assurance

Binance announced that it has set aside more than $6.34 billion in its user protection fund and corporate treasury to cover losses across affected assets. In an Oct. 31 update, the exchange affirmed that XRP and nine other cryptocurrencies are “100 % fully backed,” with a 90 % overall replenishment of reserves. Binance plans to resume withdrawals after completing security validations, targeting a Nov. 1 reopening and a full proof of reserves for the ten assets by Nov. 3.

What to watch next

Observers will monitor whether law‑enforcement agencies can trace the attacker’s address and recover any of the stolen XRP, as well as how Ripple’s RLUSD freeze impacts the broader stablecoin market. Binance’s upcoming proof‑of‑reserves audit and any further disclosures about the breach’s root cause will also be closely followed.