The hacker behind Binance’s ~$6.3 billion hack moved all 233.46 million stolen XRP to 6 new wallets on Monday.

Unlike the stablecoins also taken in the theft, native XRP has no issuer who can freeze it.

Nine payments emptied the holding address in eight minutes

According to the XRP Ledger records, the holding address made six test payments of 1,000 XRP each starting at 03:47 UTC. Between 03:52 and 04:00 UTC, nine large payments were made.

In the end, five wallets took in about 40 million XRP each. Three got it in two installments: 30 million and 10 million.

The sixth took 33.46 million. The original address retained 23.7 XRP.

At Monday’s price of ~$1.26 for XRP, the coins were worth about $294 million. Whale Alert spotlighted a single transfer of 40 million XRP worth around $50.4 million from an address it labels as “Binance Hack 2026.”

The attacker also sent 1,000 XRP to a seventh, separate address at 02:12 UTC. The coins were in the holding address for around 80 hours before the large payments were made.

Five Binance wallets sent the whole 233.46 million XRP to that address in about four minutes on October 29. Ledger data at 07:27 UTC Tuesday revealed none of the six new wallets had sent anything out.

Gate took in $250,000 of the loot over 12 hours

As per the XRP Ledger docs, native XRP cannot be frozen on the ledger. Ripple froze stolen RLUSD tied to the breach, but those issuer controls only go so far as its own stablecoin.

Now the task is to trace the six wallets and for exchanges to reject deposits to get back the XRP.

The split appears to be a laundering step. Six balances mean more trails to follow and smaller lots to cash out.

On-chain tracker Lookonchain said around $250,000 of the plunder was moved to the exchange Gate over 12 hours.

The attack resulted in about $628 million in assets being stolen on Tron. Tether froze around 378.7 million USDT, but analyst SomaXBT estimates that about $242 million slipped out through Tron-linked routes in two days.

Some $140 million of it passed through services such as Relay and THORChain, whose node operators were asked by the FBI to block the funds. Those estimates put Relay’s volume at almost $48 million and THORChain’s at $44 million.

Cryptopolitan reported that the industry has frozen around $3 billion of the stolen assets. The FBI blames TraderTraitor, the name it gives to a state-linked North Korean hacking operation, saying the attackers are turning stolen crypto into Ether.

However, North Korea’s Kim Yo Jong denied the FBI’s accusation, calling it “an absurd rhetoric and nothing new,” in an official statement released November 2.

Binance said company funds have compensated about 95% of the amount affected. The exchange also said it has full backing for its XRP balances.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It’s free.