Binance Hacker Moves $293M in XRP Across Six Wallets as ETF Inflows Continue

Binance Hacker XRP Transfers Put $293 Million in Focus

The latest Binance hacker XRP transfers have raised fresh concerns across the cryptocurrency market after an attacker moved 233.46 million XRP, worth approximately $293 million, into six newly created wallets on November 2, 2026.

The movement comes just days after Binance experienced a major security breach involving an estimated $6.3 billion in cryptocurrency. The stolen XRP had remained in the attacker's wallet for roughly 80 hours before being redistributed across six separate addresses.

Blockchain transaction monitoring identified several large transfers between 03:52 and 04:00 UTC. Before moving the funds, the attacker reportedly sent small test transactions to the six receiving wallets.

At the time of the initial investigation, none of the six wallets had made further outgoing transfers.

The development is particularly concerning because native XRP cannot be frozen by Ripple. Unlike certain stablecoins, XRP does not have a central issuer with the ability to blacklist individual wallet addresses and prevent transfers.

Meanwhile, the XRP market is showing a different kind of activity. US spot XRP exchange-traded funds (ETFs) attracted $8.43 million in net inflows on October 29, led by Franklin Templeton and Bitwise.

These developments create an interesting situation for XRP investors: while institutional investment products continue attracting capital, a significant amount of stolen XRP remains under the control of an attacker.

Hacker Splits 233.46 Million XRP Across Six Wallets

The latest movement involved approximately 233.46 million XRP originally transferred from Binance-associated wallets during the October 29 security incident.

According to blockchain transaction tracking, the attacker initially kept the funds in a single XRP Ledger address.

After approximately 80 hours without further movement, the attacker began distributing the holdings.

The process started with test transactions of 1,000 XRP to six newly created wallets. Larger transfers followed within minutes.

The distribution looked like this:

Dollar values are approximate and based on the reported XRP price near $1.26.

The six transfers effectively divided a large, identifiable balance into smaller holdings across separate addresses.

This does not mean the funds have become untraceable.

The XRP Ledger is a public blockchain, meaning transactions and wallet balances can be examined by investigators, analytics firms and other market participants.

However, splitting funds across several wallets can complicate the investigation and create additional steps for exchanges and law enforcement when attempting to intercept the assets.

Why Did the Attacker Move the XRP?

There is no publicly confirmed explanation from the attacker.

However, distributing cryptocurrency across multiple wallets is a common technique observed in laundering investigations.

It can serve several purposes:

• Separating funds into smaller balances.

• Creating additional wallet addresses for future transactions.

• Preparing assets for transfers to exchanges or other blockchain networks.

• Making the investigation more complicated by increasing the number of addresses involved.

The important point is that wallet splitting alone does not prove that laundering has been completed.

At the time of the initial reporting, the six receiving wallets had not made outgoing payments.

That means investigators and cryptocurrency exchanges may still have an opportunity to monitor the funds if they move toward identifiable custodial platforms.

Why Ripple Cannot Freeze the Stolen XRP

One of the biggest challenges in this incident is the difference between native XRP and issuer-controlled stablecoins.

Ripple has certain administrative controls over RLUSD, its dollar-pegged stablecoin.

These controls can allow the issuer to freeze specific RLUSD holdings under applicable circumstances.

Native XRP works differently.

XRP is the asset used on the XRP Ledger, and there is no central issuer-level mechanism that allows Ripple to freeze arbitrary XRP balances simply because an address is suspected of holding stolen funds.

This distinction has important consequences for recovery efforts.

Even if blockchain investigators identify the attacker's wallet addresses, they cannot automatically prevent the owner from transferring native XRP.

Can the Stolen XRP Still Be Recovered?

Yes, recovery may still be possible, but it requires cooperation from other participants.

Centralized cryptocurrency exchanges can monitor incoming deposits and restrict access to funds when they identify assets linked to a reported theft, subject to applicable legal and operational procedures.

Law enforcement agencies can also work with exchanges and blockchain analytics companies to trace the movement of stolen assets.

The challenge becomes more complicated when attackers use services that obscure transaction origins or move funds through multiple networks.

Elliptic's investigation into the Binance breach has highlighted an important difference between recoverable stablecoins and assets that cannot be frozen by an issuer.

Its November 1 analysis identified approximately $2.85 billion in frozen or seized funds, while significant amounts of cryptocurrency remained outside those controls.

Native XRP was among the assets that had not been frozen.

This is why the six new wallets matter.

The funds remain visible on the XRP Ledger, but visibility does not equal control.

How the $6.3 Billion Binance Hack Connects to the XRP Transfers

The XRP movement is part of a much larger security incident involving Binance.

The exchange reported a security incident with an estimated impact of approximately $6.3 billion in cryptocurrency.

The FBI subsequently attributed the attack to TraderTraitor, a North Korean state-sponsored cyber unit.

According to the FBI's findings reported by Reuters, the group was observed converting stolen cryptocurrency into Ethereum and investigators expected further laundering activity.

Binance initially suspended certain deposit and withdrawal services while responding to the incident.

The exchange later announced that it would resume withdrawals in phases after recovering or covering approximately 95% of the affected assets.

The remaining 5% consisted of less-liquid assets that could take longer to obtain in the necessary quantities.

The XRP movement is significant because it demonstrates that recovery efforts remain complicated even after an exchange has restored much of its customer protection.

For a deeper look at the original incident, read Bitnxt's coverage of Binance's $6.3 billion security incident and its commitment to cover affected losses.

The Attack Is Bigger Than One XRP Wallet

The Binance breach has affected multiple cryptocurrency networks and assets.

The incident involved movements across different blockchain environments, creating a complex recovery process for exchanges, stablecoin issuers and security investigators.

Some stolen stablecoins could be frozen by their respective issuers.

However, assets such as XRP and other native cryptocurrencies do not offer the same centralized freeze mechanism.

This creates different recovery possibilities depending on the asset involved.

It also demonstrates why cross-chain monitoring is becoming increasingly important in cryptocurrency security.

A stolen asset may begin on one network, move to another and eventually reach a centralized exchange or decentralized financial application.

Each additional step creates new monitoring and intervention challenges.

XRP ETF Inflows Reach $8.43 Million Despite Security Concerns

While the stolen XRP movement has attracted attention, institutional investment products linked to XRP have continued recording positive inflows.

According to SoSoValue data, US spot XRP ETFs recorded approximately $8.43 million in net inflows on October 29, 2026.

Franklin Templeton's XRPZ ETF attracted approximately $5.57 million, while Bitwise's XRP ETF received around $2.86 million.

Together, the two products accounted for the entire reported positive inflow that day.

The breakdown was:

The daily inflow was particularly notable because XRP ETFs had experienced weaker activity earlier in October.

The funds recorded outflows during the October 12–16 period, ending a 13-week streak of consecutive weekly inflows.

However, demand returned later in the month.

During October 26–30, US spot XRP ETFs recorded approximately $4.33 million in net inflows.

The weekly figure is smaller than the October 29 daily inflow might suggest because the funds also experienced withdrawals during the same reporting week.

This illustrates why daily ETF figures should always be considered alongside the full weekly picture.

For additional market context, Bitnxt recently covered how XRP ETFs attracted $8.43 million as Franklin Templeton and Bitwise led inflows.

Why ETF Inflows and the Hacker's XRP Movements Tell Different Stories

At first glance, the combination of positive ETF inflows and a large stolen XRP movement may appear contradictory.

However, these developments measure two completely different activities.

ETF inflows represent investor demand for regulated financial products that provide exposure to XRP.

The stolen XRP movement represents the redistribution of cryptocurrency associated with a security breach.

Neither figure directly explains the other.

ETF Inflows Do Not Guarantee an XRP Price Rally

When investors subscribe to spot XRP ETFs, the funds generally create additional exposure backed by XRP holdings.

This can increase demand for the underlying asset.

However, ETF inflows alone cannot guarantee that XRP's market price will rise.

Price movements also depend on broader market conditions, trading activity, liquidity, investor positioning and available supply.

Similarly, a large stolen XRP balance does not automatically create selling pressure.

The attacker must actually move or sell the assets before they can have a direct effect on available market liquidity.

If the stolen XRP remains in inactive wallets, it represents a security concern rather than confirmed selling activity.

What Do the ETF Numbers Actually Show?

Historical cumulative net inflows into US spot XRP ETFs reached approximately $1.81 billion by October 29, according to SoSoValue figures reported by ChainCatcher.

The funds' combined net assets were approximately $1.465 billion at that snapshot.

These are different measurements.

Cumulative net inflows track the net money entering the products over time, while net assets reflect their current portfolio value after market movements and other adjustments.

A decline in XRP's market price can reduce ETF assets even when investors continue adding money.

This is an important distinction when evaluating institutional demand.

Bitnxt previously examined the same issue in its report on Bitwise's XRP ETF surpassing $541 million in assets.

The broader takeaway is that ETF adoption should be measured through several indicators rather than one headline number.

Could the Stolen XRP Affect the XRP Market Price?

The movement of 233.46 million XRP has naturally raised questions about potential selling pressure.

However, it would be premature to conclude that the attacker is preparing to dump the entire balance.

The XRP holdings are currently associated with six separate wallets, and the initial investigation found no further outgoing payments from those addresses.

Several possible outcomes remain.

Scenario 1: The funds remain inactive

The attacker may keep the assets in the six wallets while waiting for an opportunity to move them.

In this situation, the immediate effect on exchange liquidity and market supply could remain limited.

Scenario 2: The funds move to centralized exchanges

If the attacker attempts to deposit XRP into identifiable exchanges, those platforms may be able to flag or restrict the funds.

This could create an opportunity for investigators to intervene.

Scenario 3: The attacker attempts further laundering

The funds could be split again, transferred through intermediaries or moved through services designed to make tracing more difficult.

That would increase the complexity of recovery efforts.

At present, there is insufficient evidence to establish which scenario will occur.

Investors should therefore avoid treating the wallet transfers as confirmation of an imminent XRP sell-off.

Bitnxt's Take: XRP Is Facing Two Very Different Tests

At Bitnxt, we believe this development deserves attention because it highlights two important sides of the XRP market.

On one side, regulated investment products continue attracting capital.

On the other, a large amount of stolen XRP remains outside the control of its legitimate owners.

These developments should not be mixed into one bullish or bearish prediction.

Institutional Demand Is Encouraging, but It Needs Consistency

The $8.43 million ETF inflow on October 29 is a positive development.

Franklin Templeton and Bitwise attracted fresh subscriptions, demonstrating that demand for regulated XRP exposure has not disappeared.

However, October's broader ETF performance was relatively weak compared with earlier months.

We believe the next few weeks of ETF data will be more important than a single positive trading session.

Consistent inflows across multiple issuers would provide stronger evidence of sustained institutional interest.

The Wallet Movement Is a Security Problem, Not Automatically a Selling Signal

The transfer of 233.46 million XRP is serious because it involves assets linked to a major exchange breach.

But the distinction between moving stolen funds and selling stolen funds matters.

Until the six wallets begin transferring assets toward exchanges or other liquidity venues, there is no confirmed evidence that the full balance is entering the market.

We also believe this incident highlights a limitation in the design of decentralized digital assets.

XRP's inability to be frozen by a central issuer supports its decentralized transfer model, but it also limits the ability of Ripple to intervene when cryptocurrency is stolen.

That is not necessarily a flaw in XRP itself.

It is a trade-off between centralized intervention and permissionless asset ownership.

The Next Major Signal Will Come From On-Chain Activity

For now, three developments deserve attention:

1. Whether the six wallets begin moving the stolen XRP again.

2. Whether centralized exchanges identify and restrict deposits linked to the attack.

3. Whether XRP ETF inflows remain positive across subsequent trading sessions.

These indicators will provide a clearer picture of the market than short-term speculation about the attacker's intentions.

Our view is that XRP's longer-term investment narrative will depend on adoption, liquidity, regulatory clarity and the strength of its ecosystem.

The Binance incident is an important security concern, but it does not automatically invalidate the institutional demand story.

What Happens Next for XRP?

The next stage of the investigation will focus on tracking the six receiving wallets and monitoring whether the funds move again.

Blockchain analytics firms can follow the assets as they move across the XRP Ledger.

Exchanges may also use wallet-screening systems to identify deposits associated with the reported theft.

At the same time, Binance's wider recovery process will remain important.

The exchange has already announced that it recovered or covered the majority of affected assets, but the remaining portion requires additional attention.

For XRP investors, ETF flow data will be another important indicator.

The return of positive subscriptions is encouraging, but sustained demand across multiple weeks would provide a more convincing signal.

The market will also be watching XRP's ability to maintain liquidity and trading stability while the security investigation continues.

Final Thoughts

The movement of 233.46 million XRP into six wallets adds another chapter to the Binance security incident.

Although the funds remain visible on the XRP Ledger, native XRP cannot be frozen by Ripple, making recovery dependent on transaction monitoring, exchange cooperation and law enforcement efforts.

At the same time, US spot XRP ETFs attracted $8.43 million in daily inflows on October 29, with Franklin Templeton and Bitwise leading demand.

These developments highlight an important distinction between the security of cryptocurrency holdings and investor demand for exposure to the asset.

Bitnxt's conclusion: XRP is facing a significant security-related challenge, but the latest wallet movement should not automatically be interpreted as a bearish price signal. The real test will be whether the attacker can move the funds into liquid markets and whether ETF demand continues despite broader market uncertainty.

For now, investors should watch both the six wallets and the ETF flow data rather than relying on either development alone.