Binance recorded an unusually large XRP whale outflow on Oct. 29, when transactions involving more than 1 million XRP reached 283 million tokens.
As a result, whale netflow also fell to -226 million XRP, making it one of the largest single-day outflows ever recorded on the exchange.
The figure was 2.72x greater than the previous record of -83 million XRP, which Binance recorded in September 2022.
However, the massive outflow did not come from a market sell-off or a sudden decision by investors to move away from XRP. It followed a major security breach that allowed an attacker to withdraw hundreds of millions of XRP from Binance.
Hackers Steal 233 Million XRP From Binance
For context, between 20:05 and 20:09 UTC on October 29, five Binance wallets sent 233.46 million XRP to a newly created address, according to a previous report from The Crypto Basic.
The attackers completed the transfers in about four minutes. Blockchain monitoring platform Whale Alert initially flagged the first transaction as a routine large transfer, but the series of movements soon raised concerns.
Two blockchain analytics firms, TRM Labs and Elliptic, later confirmed the breach. TRM Labs traced all 233.46 million XRP from the five Binance wallets to an address controlled by the attacker. Elliptic also identified approximately 233 million XRP in related transfers.
Binance later revealed that the attack affected several blockchain networks, including XRP Ledger, Ethereum, Bitcoin, Tron, and Solana, as well as four other blockchains.
The attacker carried out the transactions within minutes, stealing approximately $6.3 billion in total. This made the incident the largest cryptocurrency exchange theft on record.
Binance’s initial investigation confirmed a compromised laptop belonging to a DevOps engineer as the likely entry point. The attacker reportedly used the access gained through the laptop to reach a service container and submit unauthorized withdrawal transactions.
XRP Falls 6.5% as Binance Halts Withdrawals
The news of the breach affected XRP price performance, with the token falling approximately 6.5% in the immediate aftermath. Bulls attempted to hold the $1.20-$1.25 support range as selling pressure increased and uncertainty spread across the market.
Binance also suspended deposits and withdrawals while its security teams investigated the incident. The suspension soon became visible in the exchange’s on-chain data, particularly in transactions involving more than 1 million XRP.
On Oct. 30, large-transfer outflows dropped to just 14.7 million XRP, representing a 94.8% decline from the 283 million XRP recorded the previous day. The drop reflected the suspension of withdrawals, which effectively stopped most users from moving their tokens off the exchange.
XRP Whale Outflows Increase After Binance Restores Withdrawals
Binance began restoring withdrawal services in phases on Nov. 1, including withdrawals involving XRP. Exchange activity picked up afterward, with large-transfer outflows rising to 80 million XRP.
This represented a 5.44-fold increase from the 14.7 million XRP recorded on Oct. 30. In addition, whale netflow remained negative at approximately −50 million XRP.
The continued negative netflow suggests that the withdrawals were not limited to movements directly linked to the security breach. Large holders kept transferring their tokens away from Binance once withdrawal services became available again.
This trend could affect XRP market conditions. Tokens moved into private wallets or cold storage are not immediately available for sale on exchanges. This could ease some short-term selling pressure. However, the outflow would make no difference if traders moved the tokens to other centralized exchanges.
Binance Pledges $6.34 Billion to Cover Losses
Binance has responded to the breach with financial commitments and updates on its security measures. The exchange pledged $6.34 billion from its own capital to cover all losses connected to the theft. In its October 31 update, Binance also confirmed that all XRP user balances remained fully backed.
The exchange has gradually restored services since November 1 as its teams continue working through the incident. Ripple also helped with the response by freezing $40.5 million worth of stolen RLUSD on Ethereum within hours of the attack.
Meanwhile, the stolen XRP remains under watch. As of November 2, the attacker had moved all 233.46 million stolen tokens into six newly created wallets, approximately 80 hours after the original theft.