# Binance Wallet Breach Results in $296 Million XRP Theft Five Binance wallets were drained of 233.46 million XRP in under five minutes. - **Source:** [Bitcoin News](https://brifing.si/source/d8aeaf1e-9839-4dad-9d25-7a6bf3fbeef8) - **Published:** 2026-11-01 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/3be74e61-9438-4b01-8d2d-3d31fefbc5fe ## Rapid XRP Ledger Breach On October 29, 2026, Binance suffered a significant security breach involving its XRP Ledger wallets. Between 20:05 and 20:09 UTC, five specific wallets transferred 233.46 million XRP to a single attacker-controlled address. This rapid drainage occurred in just over four minutes, leaving only the minimum required account reserve in each affected wallet. ## Multi-Chain Attack Scope The incident extended far beyond the XRP Ledger, impacting nine different blockchain networks. Investigators from TRM Labs and Arkham identified that after the initial XRP theft, the attacker moved approximately $6 billion across 141 transfers. Binance wallets on Ethereum, Bitcoin, Tron, and Solana were also compromised, indicating a systemic failure of signing access. ## Stablecoin Recovery Efforts Ripple took immediate action to mitigate losses by freezing 40.5 million stolen RLUSD tokens on the Ethereum network at 10:01 p.m. UTC. While the attacker had already sold 48 million of the 88.5 million stolen RLUSD, these issuer-level controls successfully prevented further movement of the remaining assets within the compromised Binance wallet. ## Compromised Signing Mechanisms Analysis by TRM Labs revealed that the attacker utilized ordinary signed transactions to move funds from Binance wallets. This suggests that the breach was not a result of a smart contract vulnerability, but rather a compromise of the exchange's internal signing access controls. Co-CEO Richard Teng confirmed that attackers bypassed critical approval protocols. ## Financial Loss Mitigation Binance committed over $6.34 billion to cover the financial losses incurred during the breach. The exchange plans to utilize its user protection fund and corporate treasury to ensure that customer balances remain fully backed. As of October 31, Binance reported that 90% of the total replenishment had been successfully completed across all assets. ## Verification and Transparency To restore user confidence, Binance published a reserve snapshot on October 31 confirming that ten major assets, including BTC, ETH, and XRP, are 100% backed. The exchange is implementing zero-knowledge proofs, allowing users to verify their individual balance inclusion without compromising privacy. A full proof for all assets is expected by November 3. ## Operational Recovery Timeline Binance has established a strict withdrawal restoration and recovery plan following the breach. The exchange is currently conducting intensive security checks and system validations to ensure the integrity of its platform. Despite the scale of the attack, Binance maintained its target date of November 1 for the full reopening of affected withdrawal services. ## Industry Security Implications This incident highlights the persistent risks associated with centralized exchange wallet management and multi-chain signing infrastructure. While issuer-level controls proved effective for stablecoins like RLUSD, the lack of similar mechanisms for native assets like XRP complicates recovery. The event underscores the necessity for exchanges to continuously harden their internal signing access protocols. ## Sources covering this story - https://news.bitcoin.com/security/xrp-hit-first-in-binance-hack-five-wallets-drained-in-about-four-minutes/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._