Binance Hack: $296 Million in XRP Stolen in Four Minutes

3 min read

Blockchain intelligence firm TRM Labs attributed the October 29, 2026 theft of $296 million in XRP from five Binance wallets to North Korea’s TraderTraitor group, part of a wider $6.36 billion attack across ten blockchains.

Binance said on October 31 that ten major affected tokens, including XRP, were fully backed, while approximately 90% of stolen assets had been replenished. The exchange said customers would not bear the financial losses.

Key Takeaways

Attack attribution: TRM Labs linked the theft to TraderTraitor, the North Korean hacking group also associated with the February 2025 Bybit breach.
XRP recovery: Native XRP cannot be frozen by an issuer, unlike certain stablecoins affected by the attack.
Wider disruption: Blockchain partners froze approximately $3 billion in affected assets, according to Binance’s initial security update.
Customer protection: Binance committed company funds and emergency reserves to replace stolen assets.

Binance Hack: $296 Million in XRP Stolen in Four Minutes — Binance Hack Drained $296 Million in XRP From Five Wallets in Four Minutes.

How the XRP Theft Unfolded

According to TRM Labs, attackers transferred 233.46 million XRP between 20:05 and 20:09 UTC. The five transactions emptied the targeted wallets except for their required minimum balances, consolidating the proceeds into one attacker-controlled address.

The XRP remained at that destination when TRM published its analysis. The blockchain’s consensus mechanism continued operating, distinguishing the theft from a failure of the underlying ledger.

Binance Identifies Possible Security Failure

In its October 30 update, Binance said its preliminary investigation pointed to a compromised DevOps engineer’s laptop, potentially allowing attackers to access a service container and submit unauthorised withdrawal transactions.

The exchange reported no evidence of leaked wallet private keys. It revoked affected address authorisations, suspended withdrawals for security checks and engaged law enforcement and blockchain intelligence partners.

Binance stated in a second security update: “We want to be clear about our commitment: Binance will absorb the financial impact of these stolen funds, not our users.”

Binance Funds Recovery and Withdrawal Plans

In its October 31 recovery announcement, Binance reported setting aside more than $6.34 billion in company funds. Its recovery arrangements included the corporate treasury, Secure Asset Fund for Users (SAFU) and Futures Insurance Fund.

The exchange continued purchasing less liquid affected tokens through market and over-the-counter transactions. These purchases were intended to restore full coverage across the remaining assets.

Binance also published a new Proof of Reserves snapshot. It expected the complete cryptographic proof by November 3, 2026, allowing eligible customers to independently verify reserve backing.

What Happens Next for Withdrawals

Binance expected withdrawals to resume on November 1, 2026, subject to security checks. Its October 31 announcement had not confirmed that services had reopened, leaving the operational restart dependent on a further official update.