Binance Hack Drains $5.9 Billion With XRP Moved First

XRP Moved First in $5.9B Binance Outflows

Nearly $5.9 billion in crypto was pulled out of wallets tied to Binance on October 29 in what on-chain analysts describe as the largest suspected breach of a crypto exchange to date, and the transfer sequence put XRP at the front of the theft. On-chain tracing published by Glassnode shows the outflows ran sequentially across several networks, with an initial estimate of $5.3 billion in moved assets climbing to close to $5.9 billion as further transfers landed. The largest components were stablecoins and Bitcoin: an estimated $1.66 billion in Tether (USDT), roughly $767 million in USD Coin (USDC) and 17,985 BTC worth about $1.45 billion. Wallets holding Ethereum (ETH), XRP, Solana (SOL) and Tron (TRX) were drained in the same sequence, and the XRP transfers came first, ahead of SOL, BTC and the remaining assets. The exchange's native BNB balance, the tracing shows, was left untouched. Analysts flagged the pattern as a coordinated drain rather than ordinary withdrawal traffic, because transfers crossed multiple chains in rapid succession within a single window. The running total remains provisional, since the stolen funds keep jumping from one address to another and estimates diverge as analysts reconcile balances. The XRP price dropped 6.5% over the last 24 hours as the outflows surfaced. Binance co-founder and former CEO Changpeng Zhao acknowledged the breach within hours, writing in a post on X: “It does look like a hack on Binance.” He told customers their funds are safe, credited Tether and Circle with freezing roughly $971 million and $823 million respectively, and said that while he no longer manages the company, he expects as a shareholder that all user funds will be fully covered. His post served as the most direct public acknowledgment from anyone close to the exchange in the hours after the alerts, and in a follow-up message he conceded the eventual losses could run higher than current estimates.

Freeze Perimeter Leaves Roughly $1 Billion

Freezes moved faster than the transfers. Tether chief executive Paolo Ardoino said his company had frozen more than 1.567 billion USDT tied to the breach, stating that protecting the industry and its partners is the issuer's main priority. Circle chief executive Jeremy Allaire confirmed separately that more than $800 million in USDC was frozen in coordination with law enforcement. Both issuers acted within hours of the first on-chain alerts. Binance then published its own update: total frozen assets stood at $2.54 billion, a figure the exchange warned could climb as its investigation proceeds. The perimeter still leaves a gap. One estimate circulating after the freezes put roughly $1 billion of exposure outside the frozen funds, and the exchange has not yet said how the attackers obtained wallet access. Custody assumptions sit at the center of the fallout, and how much of an exchange's reserve belongs in a cold wallet rather than operational hot wallets is the question every venue will now face. If the largest estimates prove accurate, the breach would eclipse Bybit's February 2025 loss of about $1.5 billion in Ethereum, an attack linked to North Korean hackers, as the biggest crypto hack ever recorded; the frozen total alone exceeds that entire prior loss. Markets repriced the risk immediately. Bitcoin briefly dipped below $79,000, Ethereum slipped under $2,300 and BNB lost about 7% in the initial selloff, and the wider altcoin market fell alongside. The breach lands on an XRP market that had been building strength: recent COINOTAG reporting tracked XRP ETF net inflows past $1.8 billion, and XRP Ledger activity had touched a 2026 high of 32,604 active accounts.

The structure of the theft matters as much as its size. Opening the sequence with XRP suggests XRP balances were mapped and moved first, and with funds still hopping between addresses the near-$5.9 billion total remains a working estimate rather than a settled loss. The effective countermeasure so far has come from the stablecoin layer, where issuer freezes stopped $2.54 billion at the source; tokens already in attacker wallets have no comparable circuit breaker. Until Binance publishes its incident report identifying the compromised wallets and the attacker transaction trail, residual exposure near $1 billion is the number to watch. The custody lesson stands: whoever controls the private key controls the coins, a hardware wallet removes the venue risk that just cost the industry close to $5.9 billion, and COINOTAG's guide to blockchain security audits explains what to check before trusting a venue.