Binance Empties Hacked Wallet of Last $101 Million in XRP

Final Sweep of the Compromised Address

Binance has emptied the hot wallet it lost to attackers last Thursday, sweeping the remaining 80 million XRP, about $101 million, into fresh internal addresses. On-chain records show two identical transfers of 40 million XRP each, dispatched 50 seconds apart to a newly created address. Both movements surfaced in network explorers within the same window, a pattern consistent with scripted consolidation rather than a manual withdrawal. The source account, rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx, has carried a red “Reported as hacked” label since the October 29 breach, and XRPSCAN account data now puts its balance at 23.7 XRP, roughly $30 at the current XRP price. The sweep stops at this corporate address. Disclosures so far name no other XRP Ledger wallet as part of the cleanup, so the bounded scope is the one account the attackers drained and its residual balance. Client-facing services were already running again before this move, the exchange having restored withdrawal operations in full, so the final sweep disturbs nothing on the user side. Emptying a wallet already flagged as hacked is planned technical consolidation rather than an emergency measure. Once explorers mark an address, any residual balance on it is a standing target, and leaving funds in place invites repeated withdrawal attempts. The remaining funds moved into new wallets isolated by the platform, provisioned on a separate HD wallet key structure, which removes the risk of further withdrawals from the compromised setup. Nothing in the available record ties the fresh destination address to any account outside the exchange's own custody.

A $6.3 Billion Breach Across Ten Chains

The drained address sat inside a far larger incident. The cross-chain attack on the crypto exchange Binance began on October 29 and spread across ten different blockchains, with total damage estimated at $6.3 billion, the largest crypto theft on record. Hot wallets on the XRP Ledger took the first hit: within five minutes of the attack starting, 233.46 million XRP, around $296 million, left them. The ten-chain spread means the XRP Ledger losses, large as they are, represent only part of that total figure. The ledger's design then forced the full zeroing-out. Unlike stablecoin issuers such as USDT or USDC, which can blacklist and freeze balances at the token level, the XRP Ledger code has no protocol-level blocking function. Neither Ripple nor independent XRP Ledger developers hold a technical switch to stop transactions, and holding a private key is the only authority the network recognizes, so a hacked address cannot be quarantined on-chain. Any balance left on one stays reachable by the attacker, which is why the exchange zeroed the account out completely. The incident dwarfs the previous record for the asset. In September, the Bitget exchange lost 103 million XRP, then valued at $157 million, in its own hack, a figure the Binance breach exceeds several times over. Market reaction has stayed quiet: no panic has been recorded, and management has committed to covering all net user losses 1:1 from corporate reserves and its SAFU fund, the exchange's insurance reserve. For the XRP ecosystem, the episode still sets an all-time negative record, and it hands readers weighing venue risk, including anyone deciding where to buy XRP, a live case study in how a platform absorbs the largest theft in the sector's history.

What the Zeroing Leaves Open

Our reading is that the final transfer was structural housekeeping, not optics. On a ledger without freeze powers, a flagged address with a balance is an open liability until it reads zero, and the two on-chain transactions, verifiable by anyone through an explorer, close that liability at its last $101 million. The compensation pledge shifts the loss onto Binance's reserves, which contains the market impact without resolving the open question: the exchange has not publicly explained how the wallet's keys were compromised, and that root-cause account is the piece still outstanding. Governance work on the ledger continues in parallel; our recent review of the XRP Ledger token-approval amendments covers the changes developers must settle before mainnet. What the sources still leave exposed is that unanswered initial-access question, bounded by no disclosure to date.