However, the massive outflow did not come from a market sell-off or a sudden decision by investors to move away from $XRP. It followed a major security breach that allowed an attacker to withdraw hundreds of millions of $XRP from Binance.
Hackers Steal 233 Million $XRP From Binance
For context, between 20:05 and 20:09 UTC on October 29, five Binance wallets sent 233.46 million $XRP to a newly created address, according to a previous report from The Crypto Basic.
The attackers completed the transfers in about four minutes. Blockchain monitoring platform Whale Alert initially flagged the first transaction as a routine large transfer, but the series of movements soon raised concerns.
Two blockchain analytics firms, TRM Labs and Elliptic, later confirmed the breach. TRM Labs traced all 233.46 million $XRP from the five Binance wallets to an address controlled by the attacker. Elliptic also identified approximately 233 million $XRP in related transfers.
Binance later revealed that the attack affected several blockchain networks, including $XRP Ledger, Ethereum, Bitcoin, Tron, and Solana, as well as four other blockchains.
The attacker carried out the transactions within minutes, stealing approximately $6.3 billion in total. This made the incident the largest cryptocurrency exchange theft on record.
Binance’s initial investigation confirmed a compromised laptop belonging to a DevOps engineer as the likely entry point. The attacker reportedly used the access gained through the laptop to reach a service container and submit unauthorized withdrawal transactions.
$XRP Falls 6.5% as Binance Halts Withdrawals
The news of the breach affected $XRP price performance, with the token falling approximately 6.5% in the immediate aftermath. Bulls attempted to hold the $1.20-$1.25 support range as selling pressure increased and uncertainty spread across the market.
Binance also suspended deposits and withdrawals while its security teams investigated the incident. The suspension soon became visible in the exchange’s on-chain data, particularly in transactions involving more than 1 million $XRP.
On Oct. 30, large-transfer outflows dropped to just 14.7 million $XRP, representing a 94.8% decline from the 283 million $XRP recorded the previous day. The drop reflected the suspension of withdrawals, which effectively stopped most users from moving their tokens off the exchange.
$XRP Whale Outflows Increase After Binance Restores Withdrawals
Binance began restoring withdrawal services in phases on Nov. 1, including withdrawals involving $XRP. Exchange activity picked up afterward, with large-transfer outflows rising to 80 million $XRP.
This represented a 5.44-fold increase from the 14.7 million $XRP recorded on Oct. 30. In addition, whale netflow remained negative at approximately −50 million $XRP.
The continued negative netflow suggests that the withdrawals were not limited to movements directly linked to the security breach. Large holders kept transferring their tokens away from Binance once withdrawal services became available again.
This trend could affect $XRP market conditions. Tokens moved into private wallets or cold storage are not immediately available for sale on exchanges. This could ease some short-term selling pressure. However, the outflow would make no difference if traders moved the tokens to other centralized exchanges.
Binance Pledges $6.34 Billion to Cover Losses
Binance has responded to the breach with financial commitments and updates on its security measures. The exchange pledged $6.34 billion from its own capital to cover all losses connected to the theft. In its October 31 update, Binance also confirmed that all $XRP user balances remained fully backed.
The exchange has gradually restored services since November 1 as its teams continue working through the incident. Ripple also helped with the response by freezing $40.5 million worth of stolen RLUSD on Ethereum within hours of the attack.
Meanwhile, the stolen $XRP remains under watch. As of November 2, the attacker had moved all 233.46 million stolen tokens into six newly created wallets, approximately 80 hours after the original theft.
