Binance Hack Drains $296 Million in XRP
Five Binance wallets sent 233.46 million XRP, worth about $296 million, to an attacker-controlled address between 20:05 and 20:09 UTC on Oct. 29, according to TRM Labs. The wallets retained only their required minimum XRP reserves. Investigators said the XRP transfers were the first in a wider breach that involved Binance-controlled wallets across multiple blockchains.
Ripple froze $40.5 million in stolen RLUSD on Ethereum and restricted RLUSD in a compromised Binance wallet. The stolen XRP had not moved as of 5 a.m. UTC on Oct. 31; unlike RLUSD, XRP cannot be frozen by its issuer.
Binance said its XRP and nine other listed crypto asset balances were fully backed. It reported that 90% of its assets had been replenished overall and set a Nov. 1 target to reopen withdrawals, subject to security checks. The exchange said it would publish a full proof of reserves for the ten assets by Nov. 3. The incident raises short-term concerns about exchange security and crypto market confidence, while Binance’s backing and recovery measures may help limit broader fallout.
Bearish
The breach is a short-term negative for crypto market sentiment. The theft of about $296 million in XRP, as part of a wider incident involving Binance wallets across multiple networks, could prompt traders to reassess exchange custody risks and move assets to self-custody. Such reactions can increase withdrawals, volatility and selling pressure, particularly for assets directly linked to the incident. The fact that XRP was the first asset moved may also keep attention on XRP flows and related exchange activity.
Past exchange hacks have often triggered an initial risk-off response, with price pressure driven as much by uncertainty about losses and withdrawals as by the stolen amount itself. Here, Binance’s statement that the affected assets are fully backed, its reported 90% replenishment and its planned recovery steps may reduce concerns about a customer shortfall. Ripple’s ability to freeze RLUSD also limits the movement of some stolen funds, although that control does not apply to XRP. The stolen XRP was reported unmoved as of Oct. 31, but tracing does not guarantee recovery.
In the short term, traders may watch Binance withdrawal status, reserve disclosures, on-chain movements and any signs of contagion to other exchanges. If withdrawals resume and the reserve proof supports Binance’s claims, market confidence could stabilise. If the investigation reveals larger losses, prolonged disruption or further security failures, the negative effect could deepen. Longer term, the incident may reinforce demand for verifiable reserves and stronger custody controls, while its impact on broad crypto prices will depend on whether the breach remains contained rather than developing into a wider liquidity or solvency concern.