A Binance hack-linked wallet moved 80M XRP worth about $101M in 50 seconds, while a separate Binance address transferred another 50M XRP.
Large XRP transfers returned to focus after an address linked to the recent Binance hack moved 80 million XRP in two transactions within just 50 seconds, while a separate Binance wallet transferred another 50 million XRP to an unidentified address.
The three transactions involved a combined 130 million XRP, worth approximately $163.3 million at the prices recorded by Whale Alert when the transfers occurred.
However, only 80 million XRP can currently be connected to the hack-linked wallet. The separate 50 million XRP transaction should not be treated as part of the exploit based on available on-chain labeling.
Binance Hack Wallet Splits 80M XRP Between Two Addresses
The most significant activity occurred early Monday, Nov. 2.
At 03:55:31 UTC, an address labeled by Whale Alert as “Binance Hack 2026” transferred 40 million XRP, valued at approximately $50.44 million, to an unknown wallet. XRP was priced at about $1.2618 when the transaction was recorded.
🚨 🚨 🚨 40,000,000 $XRP (50,456,669 USD) transferred from Binance Hack 2026 to unknown wallethttps://t.co/blef9pgplA
— Whale Alert (@whale_alert) November 2, 2026
Exactly 50 seconds later, at 03:56:21 UTC, the same sender moved another 40 million XRP to a different unidentified wallet. Whale Alert valued the second transfer at approximately $50.46 million.
🚨 🚨 🚨 40,000,000 $XRP (50,444,880 USD) transferred from Binance Hack 2026 to unknown wallethttps://t.co/82251tb0Qm
— Whale Alert (@whale_alert) November 2, 2026
Combined, the hack-linked address therefore shifted 80 million XRP worth roughly $100.9 million in less than one minute.
The sender, rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx, is the same address that received approximately 233.46 million XRP during Binance’s Oct. 29 security breach. Those tokens arrived through five transactions over roughly four minutes.
Before the latest transfers, blockchain monitoring showed the entire 233.46 million XRP balance sitting at that address without outbound activity. The movement of 80 million XRP therefore marks a notable change in the XRP portion of the stolen-fund trail.
The 80 million XRP represents about 34.3% of the 233.46 million XRP originally transferred to the address, based on our calculation.
Another 50M XRP Leaves Binance
A third large transaction occurred earlier, on Nov. 1 at 15:04:01 UTC.
🚨 🚨 🚨 50,000,000 $XRP (62,434,112 USD) transferred from #Binance to unknown wallethttps://t.co/VKqQqnIRhH
— Whale Alert (@whale_alert) November 1, 2026
Whale Alert recorded 50 million XRP, worth about $62.43 million, moving from a Binance-labeled wallet to another unknown address. XRP was valued at approximately $1.2486 during that transfer.
There is currently no evidence in the transaction data supplied by Whale Alert connecting this 50 million XRP movement with the attacker address.
Large exchange withdrawals can represent custody reorganizations, customer withdrawals or movements to private wallets. Without identifying the receiving wallet, the transaction alone cannot establish whether the XRP was purchased, accumulated by a whale or moved internally.
Stolen XRP Starts Moving After Binance Hack
The activity comes days after Binance disclosed that unauthorized withdrawals from compromised hot-wallet infrastructure resulted in approximately $6.3 billion in stolen crypto assets on Oct. 29. The exchange said it would absorb the losses rather than pass them to customers.
Binance subsequently said XRP and several other major assets were again 100% backed, while the exchange had recovered or covered approximately 95% of the total affected assets by Nov. 1.
XRP is currently trading around $1.25, according to CoinMarketCap.
The next on-chain development to watch is whether the two wallets that received the 40 million XRP transfers begin dispersing the tokens further, particularly toward identifiable exchanges or swapping infrastructure.