233 Million XRP in 6 Wallets Nobody Can Freeze: The Binance Hacker's $294M Move — and the One Coin Ripple DID Stop

On Monday, November 2, 2026, the hacker behind the $6.3 billion Binance theft moved all 233.46 million stolen XRP into six brand-new wallets in about eight minutes — and there is nothing Ripple, Binance, or any regulator can do to freeze those coins. That single fact separates XRP from the stablecoins stolen in the same heist, where issuers have already frozen billions, and it is the most important lesson for every XRP holder to understand this week.

At Monday's price of roughly $1.26 per XRP, the six wallets hold about $294 million. Five of them received roughly 40 million XRP each, and the sixth received 33.46 million. The original holding address was left with just 23.7 XRP — dust. According to XRP Ledger records, none of the six new wallets had sent anything out as of Tuesday morning, which means investigators are now watching six ticking clocks instead of one. The question is no longer whether the coins can be frozen. They cannot. The question is whether exchanges will refuse them when the hacker eventually tries to cash out.

This article explains exactly what happened, why native XRP cannot be frozen while Ripple's own stablecoin RLUSD can, and what XRP holders should check today. The short version: if your coin has an issuer with a freeze switch, your coins can be stopped. If it does not, only exchanges and law enforcement stand between a thief and your market.

What Happened: 233.46 Million XRP, Six Wallets, Eight Minutes

The transfers began quietly. According to XRP Ledger records reported this week, the holding address made six test payments of 1,000 XRP each starting at 03:47 UTC on Monday. Test payments are a classic laundering tell: a thief sends a tiny amount first to confirm the destination address works before moving the real money. Between 03:52 and 04:00 UTC, nine large payments followed and emptied the address. Three of the receiving wallets got their 40 million XRP in two instalments — 30 million plus 10 million — while the others received single transfers. A seventh, separate address received 1,000 XRP at 02:12 UTC, possibly another test or a decoy.

Whale Alert spotlighted a single transfer of 40 million XRP worth around $50.4 million from an address it labels "Binance Hack 2026." Five Binance wallets had sent the whole 233.46 million XRP to the holding address in about four minutes on October 29, the day of the heist itself. The hacker waited four days, then split the stash.

Why split it at all? Six balances mean six trails to follow, six wallets for exchanges to blacklist, and six separate cash-out attempts instead of one giant, instantly recognisable transfer. It is also a hedge: if one wallet is identified and its deposits blocked everywhere, the other five still work. Splitting does not make the coins harder to trace — every XRP Ledger transaction is public — but it makes them harder to stop in practice, because every exchange, bridge, and over-the-counter desk must block all six addresses, not just one.

Why Nobody Can Freeze Native XRP

Here is the technical fact at the heart of this story, and the one most headlines skip: native XRP has no issuer who can freeze it. The XRP Ledger's own documentation confirms that XRP itself cannot be frozen on the ledger. Freezing is a feature of issued tokens on the ledger — assets created by a specific issuer, which can include that issuer's stablecoins. Ripple froze stolen RLUSD tied to the breach, because RLUSD is Ripple's token and Ripple controls its issuer account. But XRP is the ledger's native asset. There is no issuer account to flip a switch on, no company that can press pause, and no upgrade that can retroactively add one without changing what XRP fundamentally is.

That is a feature, not a bug — until it is stolen. The same property that makes XRP censorship-resistant for ordinary users makes it censorship-resistant for thieves. Bitcoin works the same way, which is why the hacker's roughly $1.4 billion in stolen Bitcoin, sitting in 19 wallets, also cannot be frozen, as we covered in our earlier report on the Binance hacker's Bitcoin wallets. Ethereum's native ETH is likewise unfreezable at the protocol level, though individual tokens built on Ethereum, like USDT and USDC, are a different story entirely.

This distinction matters far beyond this one hack. When people ask "can stolen crypto be recovered," the honest answer is: it depends entirely on which crypto was stolen. The table below lays out the two worlds that collided in the Binance heist.

The Freeze Table: What Can Be Stopped and What Cannot

Asset stolen in the Binance hack	Can the issuer freeze it?	What actually happened
USDT (Tether)	Yes — Tether controls USDT issuance	Tether froze around 378.7 million USDT on Tron alone, and roughly $3 billion of stolen assets have been frozen industry-wide
RLUSD (Ripple's stablecoin)	Yes — Ripple controls RLUSD issuance	Ripple froze stolen RLUSD tied to the breach
Native XRP	No — no issuer exists for XRP	233.46 million XRP ($294 million) split into six wallets; nothing frozen, nothing freezable
Native BTC	No — Bitcoin has no issuer	About $1.4 billion in Bitcoin sits in 19 wallets nobody can freeze
Native ETH / SOL	No at protocol level	The hacker is separately converting 970,522 SOL (about $96 million) into Bitcoin to obscure the trail
Tokens on Ethereum / other chains	Sometimes — depends on the token's contract	Some issuers froze tokens; others, like PEPE or governance tokens, have no freeze function

The pattern is unmistakable. Every dollar that has been successfully frozen so far was an issuer-controlled token. Every dollar that keeps moving is a native coin or a token without a freeze switch. That is why the industry's headline "$3 billion frozen" figure, while real, is misleading if you read it as "the hack is being undone." Roughly half the $6.3 billion haul was in forms that can be frozen. The other half — Bitcoin, XRP, ETH, SOL and similar assets — can only be watched, blacklisted at exchanges, and pursued through law enforcement.

The $250,000 That Already Slipped Through to Gate

Freezing only works if the thief has not already cashed out, and the XRP trail shows how fast that window closes. On-chain tracker Lookonchain reported that around $250,000 of the plunder was moved to the exchange Gate over 12 hours. That is a small fraction of $294 million, but it proves the pipeline works: stolen coins reach an exchange, and once they are sold or withdrawn as other assets, the trail goes cold.

This is now the central race. Investigators have published the six wallet addresses, and the job of every exchange is to reject deposits from them. But exchanges are not a single system — they are hundreds of companies in dozens of jurisdictions, and the hacker only needs one slow, small, or careless venue. South Korea's experience this week shows the gap: Korean exchanges are now seeking regulatory changes that would let them promptly halt withdrawals following hacks at other platforms, after the country's top financial regulator convened an emergency meeting on Monday. Under current Korean rules, the Virtual Asset User Protection Act bars exchanges from arbitrarily blocking deposits and withdrawals, permitting such measures only on legitimate grounds set out in a presidential decree. In other words, even exchanges that want to help can find their hands tied by rules written for normal times.

Binance says company funds have compensated about 95% of the amount affected and that it has full backing for its XRP balances — ordinary Binance users should not lose money from this theft even if the hacker cashes out. That is not the same as recovery: compensation comes from Binance's pocket, not from the hacker's wallets, and it does nothing to stop the stolen XRP from eventually hitting the market.

The Laundering Playbook: Stage Two Has Begun

Blockchain analytics firm Chainalysis says the North Korean hackers behind the theft — attributed by the FBI to TraderTraitor, a state-linked operation — appear to have entered a second stage of laundering. Stage one was parking the loot in holding wallets. Stage two is moving it out of those wallets, across chains, and into Bitcoin, which is harder to trace through chain-hopping and mixing services. The XRP split fits that pattern exactly, as does the separate conversion of 970,522 SOL into Bitcoin that we reported earlier this week.

North Korea's Kim Yo Jong denied the FBI's accusation on November 2, calling it "absurd rhetoric and nothing new." The denial changes nothing operationally: the wallets are public, the transfers are on-chain, and the laundering pattern matches previous North Korean operations documented by US authorities. What matters for the market is the mechanics — a large, patient seller now controls $294 million in XRP, plus billions more in other coins, with every incentive to sell slowly and quietly rather than all at once.

That is the real price risk for XRP holders. Not a sudden dump — a thief who dumps 233 million XRP on one exchange would crash the price against himself — but a slow bleed: small sales across many venues over months, each one adding invisible sell pressure while XRP tries to recover. XRP traded around $1.23 to $1.26 this week, and an overhang of this size does not help.

What Most People Get Wrong About "Frozen" Crypto

Three myths keep circulating after every major hack, and all three are wrong in ways that cost ordinary holders money.

Myth 1: "The blockchain is transparent, so stolen crypto always gets recovered." Transparency is not recovery. Every transfer in this story is visible to anyone with an internet connection, yet not a single XRP has been recovered. Watching a thief move money is not the same as stopping him. Recovery requires either an issuer freeze switch, an exchange refusing a deposit, or law enforcement seizing funds — and for native coins, only the last two exist.

Myth 2: "Stablecoin freezes prove crypto is centralised and unsafe." The freeze switch cuts both ways. Tether's ability to freeze $378.7 million in USDT on Tron is exactly what stopped part of this heist from being laundered, and our earlier analysis of whether Tether can freeze your USDT explains the trade-off in full: the same power that stops thieves can, in principle, be used against ordinary users. If you hold USDT, you accept an issuer who can freeze it. If you hold XRP or BTC, you accept that nobody can freeze a thief's coins either. There is no version of crypto that gives you both guarantees at once.

Myth 3: "If my exchange is big, my coins are safe there." Binance is the world's largest exchange, and it was still breached for $6.3 billion through hot wallets — wallets connected to the internet. Size is not security. What protects you is not your exchange's brand but where your coins actually sit: on the exchange, in a hot wallet you control, or in cold storage offline. Our guide to buying crypto safely and our beginner's wallet comparison walk through that decision step by step, and the lesson of this week is the same one every hack teaches: coins you plan to hold long-term do not belong on any exchange.

The Mercado Bitcoin Parallel: $9 Million Frozen, $8 Million Moved

The same freeze asymmetry played out in miniature this week at Brazil's Mercado Bitcoin, which suffered a separate $40 million-plus breach across at least ten blockchains. On November 3, the Mercado hacker moved about $8 million in Ethereum to new wallets — including a single transfer of about 2,900 ETH worth $6.52 million — while Tether froze more than $9 million linked to the attack after Chainalysis coordinated with issuers within 30 minutes of identifying the addresses. The exchange says it contained the incident and that customers suffered no harm, and investigators are watching for deposits into Tornado Cash, though none have been confirmed so far.

The Mercado hacker's remaining portfolio is a warning about small-token overhang: about 372.99 billion PEPE worth $1.79 million, 12,820 AAVE worth $1.61 million, 769,950 PENDLE worth $1.35 million, 1.98 million VIRTUAL worth $1.15 million, 147,840 UNI worth $1.04 million, and 2.67 million ONDO worth $1.03 million. None of those tokens has an issuer freeze switch comparable to USDT's, so if the hacker sells them, the only defence is exchange blacklists. Holders of PEPE, AAVE, PENDLE, VIRTUAL, UNI, or ONDO should understand that a known seller holding seven figures of their token is now part of their market — whether the price reflects it yet or not. We covered the original Mercado breach and its seven checks for exchange users earlier this week.

5 Checks for XRP Holders This Week

Whether you hold XRP or any other coin, this week's events translate into five concrete actions. First, check where your coins actually live: if a meaningful amount sits on an exchange, consider moving long-term holdings to a wallet you control — our post-hack safety checklist covers the transfer process. Second, understand your coin's freeze status before assuming anything about recovery: USDT and RLUSD can be frozen by their issuers, XRP and BTC cannot. Third, watch the six XRP wallets on a block explorer or tracker like Arkham and set alerts — early warning of a large transfer to an exchange is the closest thing to an early warning of sell pressure. Fourth, be sceptical of any "recovery service" message this week: no legitimate service will ask for your seed phrase. Fifth, if you trade on decentralised exchanges, remember that DEX volumes just hit a record share of spot trading — but DEXs cannot blacklist a hacker's wallet either.

What Happens Next: 3 Scenarios for the $294 Million

Scenario 1 — Slow bleed (most likely). The hacker sells small amounts across many venues over months, exchanges block what they catch, and XRP absorbs a steady, mostly invisible headwind. Price impact is real but diffuse, and most holders never connect any single dip to the hack.

Scenario 2 — A venue slips. One exchange fails to blacklist all six wallets, or a peer-to-peer desk accepts a large tranche, and a sudden multi-million-dollar sale hits the market in a single session. Expect a sharp, unexplained XRP drop followed by on-chain detectives identifying the sale hours later.

Scenario 3 — Seizure or negotiation. Law enforcement identifies an exchange account or intermediary holding part of the loot and seizes it, or a portion is recovered through the same issuer-freeze and governance mechanisms that recovered other assets. This is the least likely outcome for native XRP specifically, because there is no freeze switch to pull — it would require catching the person, not the coins.

Whichever scenario plays out, the structural lesson is permanent: in crypto, "frozen" is a property of specific tokens, not of the asset class. The Binance hacker's XRP cannot be frozen, and every future hack will split along exactly the same line — issuer-controlled tokens stopped, native coins watched but unstoppable. Holders who understand that line before the next hack will make better decisions than holders who learn it from a headline about their own coin.

Frequently Asked Questions

Can Ripple freeze the hacker's XRP?

No. Native XRP has no issuer and cannot be frozen on the XRP Ledger. Ripple can freeze RLUSD, its own stablecoin, because Ripple controls that token's issuer account — but it has no equivalent control over XRP itself.

How much XRP did the Binance hacker move, and where is it now?

The hacker moved 233.46 million XRP, worth about $294 million at roughly $1.26 per XRP, into six new wallets on November 2, 2026. Five wallets hold about 40 million XRP each and the sixth holds 33.46 million. As of November 3, none of the six wallets had sent funds onward.

Why did the hacker split the XRP into six wallets?

Splitting creates multiple trails and multiple cash-out attempts. If one wallet is blacklisted everywhere, the others may still work, and smaller individual transfers attract less attention than a single 233-million-XRP movement.

Can stolen crypto be recovered at all?

Sometimes. Issuer-controlled tokens like USDT and RLUSD can be frozen by their issuers, and exchanges can refuse deposits from known hacker wallets. Native coins like XRP and BTC cannot be frozen at the protocol level, so recovery depends on exchanges blocking deposits or law enforcement seizing funds from intermediaries.

Is my XRP on Binance safe after the hack?

Binance says company funds have compensated about 95% of the amount affected and that it has full backing for its XRP balances, so ordinary users should not lose funds from the theft itself. That is separate from price risk: a large known seller holding $294 million in XRP is a market overhang regardless of compensation.

Should I sell my XRP because of the hacker wallets?

That depends on your investment thesis, not on the hack alone — this article is not financial advice. What the hack changes is the risk picture: a patient, motivated seller controls a large XRP position, and holders should weigh that overhang alongside XRP's fundamentals, which we assess in our honest guide to buying XRP in 2026.

Conclusion

The image of this hack week is a split screen: on one side, Tether freezing $9 million linked to Mercado Bitcoin within hours and $378.7 million in USDT on Tron; on the other, 233.46 million XRP gliding into six wallets that no company on earth can freeze. Both halves are crypto working exactly as designed. Know which kind of crypto you hold, know whether anyone can stop it from moving, and never assume that "frozen" applies to your coins until you have checked.

Sources: TradingKey / Cryptopolitan on the XRP wallet split, CryptoDigicurrency on the Mercado Bitcoin hacker's ETH moves and Tether freeze, Korea Times on Korean exchanges and the laundering stage, CoinDesk on Bitcoin's November 3 market backdrop.