On-chain data shows how hackers moved nearly $300 million worth of XRP from Binance during a major security breach that cost the exchange $6.3 billion.
On the evening of Oct. 29, blockchain monitoring platform Whale Alert flagged a large XRP outflow from Binance worth nearly $300 million. At first, the transaction looked like a regular exchange withdrawal and attracted little attention.
However, closer examination linked the transfer to what investigators now call one of the largest crypto exchange exploits in history, with a reported loss of about $6.3 billion.
Over 233M XRP Moved from Binance in 4 Minutes
The XRP transfers occurred within a four-minute window. At 8:05 PM UTC, the Binance (6) XRPL wallet activated a newly created address, rk2…zMx, by sending it 185 million XRP worth $235.8 million at the time.
Whale Alert recorded the transfer as a routine outflow, and the transaction data showed no sign of an ongoing breach. However, several more transfers followed within minutes, revealing a pattern of activity involving multiple Binance wallets.
At 8:07 PM UTC, the Binance (9) wallet sent 14.69 million XRP worth $18.7 million to the same address. Within another minute, the Binance (18) and Binance (15) wallets transferred 13.14 million XRP valued at more than $16.7 million and 11.955 million XRP worth $15.23 million, respectively, to rk2…zMx.
By 8:09 PM UTC, the Binance (10) wallet had sent another 8.655 million XRP worth more than $11 million to the address.
In total, five Binance wallets transferred 233.4 million XRP valued at $297 million to a single newly activated address in just four minutes. This pattern raised concerns within the XRP community.
XRPScan Flags the Address as Compromised
After receiving the transfers, the address rk2…zMx continued to hold the full 233.4 million XRP. At the time of reporting, the address had recorded no outgoing transactions since the final transfer arrived at 8:09 PM UTC.
XRPScan, a leading XRP Ledger block explorer, has since labeled the address as compromised, alerting the community that the account had been linked to a reported hack and that the assets sent to it likely represented stolen funds.
The XRP transfers marked the beginning of the broader Binance exchange hack, which reportedly resulted in losses exceeding $6 billion.
Compromised Laptop Linked to the Broader Attack
Binance’s initial investigation showed that the broader attack occurred due to a DevOps engineer’s compromised laptop. According to the exchange’s findings, the attackers used that access to enter a service container and carry out a series of unauthorized withdrawal transactions.
The exchange said its review found no evidence that attackers had obtained private keys from its wallets. This confirmed that the breach occurred at the application access level, not through a direct compromise of the cryptographic keys.
The attackers reportedly drained approximately $6.36 billion across ten different blockchains, completing most of the transactions within about 20 minutes.
Binance responded by suspending deposits and withdrawals while working with blockchain analytics firms and law enforcement agencies to trace the stolen funds and recover the assets.
These efforts allowed Binance’s partners to freeze approximately $3 billion on-chain. Tether contributed more than $1.56 billion in frozen stablecoin holdings to that total.
North Korean Hackers Identified as Suspects
Blockchain intelligence firms TRM Labs and Chainalysis identified TraderTraitor, a North Korean state-sponsored hacking group, as the likely culprit behind the breach. Both firms highlighted similarities in the attack’s execution, the movement of assets, and the methods used to target the exchange.
Their findings also compared the Binance exploit to the February 2025 Bybit hack, which resulted in about $1.5 billion in losses. The FBI previously linked that attack to TraderTraitor.
Binance pledged to cover all losses suffered by users, using its approximately $1.2 billion Secure Asset Fund for Users (SAFU) alongside additional company funds to cover any remaining shortfall. Co-founder Changpeng Zhao also publicly backed the commitment, stating that he expected every affected user to receive full compensation.