The Binance hacker has moved all 233.46 million stolen XRP, worth about $293 million, into six new wallets after the coins sat untouched for roughly 80 hours. Native XRP cannot be frozen by an issuer, so recovery depends on tracing and on exchanges blocking deposits.
The Binance hacker moved all 233.46 million stolen XRP into six new wallets on Nov. 2. The haul is worth about $293 million, and the coins had sat untouched for roughly 80 hours.
Nine large transfers hit six wallets
The attacker's address on the XRP Ledger sent test payments of 1,000 XRP to six new wallets, then made nine large payments between 03:52 and 04:00 UTC. After the test transfers, the address held just 23.7 XRP.
Five of the receiving wallets now hold about 40 million XRP each, while the sixth holds 33.46 million XRP. As of 04:37 UTC, none of the six had sent funds onward.
With XRP trading near $1.26, the stash is worth about $293 million.
Why the XRP cannot be frozen
Unlike stablecoins, native XRP has no issuer that can freeze it. Ripple froze stolen RLUSD linked to the attack, but those issuer freeze controls do not apply to XRP.
Blockchain analytics firm Elliptic found the XRP was in place as of Oct. 31. The latest split is therefore likely a laundering step, because it creates more trails for investigators and lets the funds move in smaller amounts.
Custodial exchanges can freeze funds they hold, according to The Defiant, which makes a later deposit a potential interception point.
Tron funds already moved
Other stolen assets were already in motion. Analysts reported that the attacker moved about $242 million through Tron-related paths within two days of the hack, after Tether froze about 378.7 million USDT.
The attacker is also testing exchanges. Lookonchain said the hacker deposited $250,000 into Gate over 12 hours.
Binance said it had replenished approximately 95% of the affected amount using company resources and that XRP balances were fully backed.
Sources: Bitcoin News, The Defiant
Trading involves risk.
Risk Disclaimer
