Binance Hack Began With $296M XRP Theft
A blockchain investigation says the Binance hack began with the theft of 233.46 million XRP, worth about $296 million. The funds were taken from five Binance wallets in coordinated transfers between 20:05 and 20:09 UTC, after attackers had prepared for at least 36 hours, according to TRM Labs.
The Binance hack then spread to other networks. About 20:20 UTC, a Binance Bitcoin hot wallet transferred 18,270 BTC, valued at roughly $1.47 billion. On Ethereum, attackers used pre-signed authorizations and EIP-7702 account-delegation functionality to sweep 167,464 ETH, USDT and other tokens. Investigators identified about $6.36 billion in transfers across ten blockchains by 00:30 UTC on October 30. TRM said the XRP remained unmoved when it conducted its investigation.
TRM attributed the operation with high confidence to TraderTraitor, a North Korea-linked hacking group, but Binance has not independently confirmed who was responsible. Binance said it froze about $3 billion in affected assets and would reimburse customers. The incident heightened exchange-security concerns and contributed to a sharp fall in BNB, according to the article.
Bearish
The news is bearish for near-term crypto sentiment because a reported $6.36 billion cross-chain theft raises concerns about exchange security, asset custody and the potential sale or laundering of stolen funds. The coordinated XRP, Bitcoin and Ethereum transfers may prompt traders to reduce exposure to exchange-linked assets and monitor for further outflows. The article also reports that BNB fell sharply, reflecting the immediate risk repricing around Binance.
The scale of the transfers does not mean that $6.36 billion was necessarily sold on the open market. TRM said the stolen XRP had not moved at the time of its investigation, and Binance reported freezing about $3 billion in affected assets. Those factors could limit immediate selling pressure. Traders are likely to watch wallet movements, exchange reserve data, token prices and any confirmed recovery or reimbursement details. Uncertainty about the precise attack method and the alleged perpetrators may sustain volatility in the short term.
Past major exchange hacks have often triggered an initial risk-off reaction, especially in the affected platform’s token, while wider market effects depended on whether stolen assets were sold and whether customer losses were covered. Over the longer term, a credible reimbursement and stronger security controls could help restore confidence. If losses remain unresolved or similar incidents recur, the event could deepen calls for tighter custody standards and weigh on trust in centralized exchanges. This is a security-driven negative catalyst, rather than evidence of a flaw in the XRP Ledger itself.