40 Million XRP Moved From Binance Hacker Wallet

The Binance hack this wallet activity traces back to drained $6.3 billion from the exchange, and the FBI has attributed the theft to North Korean hackers, a group long tied to exchange breaches and mixer-heavy laundering. XRP sits outside the stablecoin model: Ripple has no central freeze switch over the native token, unlike Tether or Circle, which routinely blacklist addresses tied to hacks. That design choice now shapes how this specific theft can be chased.

Binance has already emptied the compromised wallet of its remaining roughly $101 million in XRP, moving exchange-held funds out of reach rather than leaving them exposed, and resumed Solana, XRP, Arbitrum and Tron withdrawals for customers on November 1. The exchange says it has replenished 95% of affected assets from its own balance sheet, meaning depositors are not absorbing the shortfall directly. The attacker, meanwhile, holds $292 million in XRP split across six static wallets with zero outgoing transactions so far.

Native XRP cannot be frozen at the protocol level, so Ripple's usual argument for a more centralized, enterprise-friendly ledger becomes a liability here: the only realistic choke point is an exchange accepting the funds on deposit. That exposes a real trade-off in blockchain design between censorship-resistant transfer and the practical need to interdict stolen funds, and it means attribution to North Korean hackers, however confident, does not by itself translate into recovery or restraint of the assets.

The six dormant wallets holding $292 million are the thing to watch: any movement toward a centralized exchange would create the first realistic interception point, since Ripple itself cannot act unilaterally on-chain. Also worth tracking is Binance's progress past its stated 95% replenishment figure, and whether law enforcement ties the laundering pattern here to prior North Korean operations such as the 2022 Ronin bridge theft, which followed a similar wallet-splitting playbook.