Alert: Binance Hacker Moves 80 Million XRP Worth $101M to Mystery Wallets

Two major XRP transfers linked to the $6.3 billion Binance hack have raised concerns over the movement of stolen cryptocurrency. According to blockchain tracking service Whale Alert, a wallet associated with the breach transferred 80 million XRP on November 2.

The transactions totaled about $100.9 million, with both transfers going to separate, unidentified cryptocurrency addresses. Their destination remains unknown, and blockchain records have not established whether the recipients intend to sell the assets.

Whale Alert recorded the first transaction shortly before 03:56 UTC, involving 40 million XRP valued at approximately $50.44 million. About 50 seconds later, the same wallet transferred another 40 million XRP, worth about $50.46 million.

Significantly, both transactions originated from an address identified as “Binance Hack 2026” in Whale Alert’s tracking records. The transfers occurred within one minute, moving substantial XRP holdings from the same source to two different destinations.

Blockchain tracking information has not identified either recipient or established the purpose behind the transfers. Furthermore, available transaction records provide no confirmation that the transferred XRP reached cryptocurrency exchanges or entered the market.

🚨 🚨 🚨 40,000,000 $XRP (50,444,880 USD) transferred from Binance Hack 2026 to unknown wallethttps://t.co/82251tb0Qm

— Whale Alert (@whale_alert) November 2, 2026

Binance Restores XRP Withdrawals Following $6.3 Billion Security Breach

The XRP movements emerged as Binance worked to restore withdrawal services following its October 29 security breach. The attack resulted in approximately $6.3 billion in cryptocurrency losses from the exchange’s hot wallets.

Following the incident, Binance temporarily suspended withdrawals while its security teams investigated unauthorized transactions and reviewed affected infrastructure. The exchange subsequently introduced a phased withdrawal restoration plan covering several major blockchain networks.

On November 1, Binance announced withdrawal restoration across 15 networks, including XRP Ledger, Bitcoin, Ethereum, Solana, and BNB Smart Chain. The initial restoration window ran between 06:00 and 09:00 UTC, subject to security and infrastructure checks.

Additionally, Binance outlined further restoration plans for Tron, Dogecoin, Zcash, Avalanche, Sui, Polygon, and Arbitrum. The exchange linked the gradual reopening process to security verification and operational readiness across supported blockchain networks.

Binance Reports 95% Asset Recovery as XRP Balances Remain Fully Backed

Binance also reported substantial progress in replenishing assets affected by the security breach. As of November 1, approximately 95% of affected cryptocurrency holdings had reportedly been restored or replenished.

The exchange confirmed that customer XRP balances remained fully backed, alongside holdings involving Bitcoin, Ethereum, Solana, and BNB. Meanwhile, the remaining 5% primarily involved cryptocurrencies with lower liquidity, complicating the final stages of asset replenishment.

These restoration efforts followed Binance’s commitment to cover customer losses through company resources and available recovery mechanisms. Meanwhile, the movement of 80 million XRP highlighted ongoing blockchain activity involving wallets associated with the attack.

Conclusion

The two November 2 transactions moved approximately $100.9 million in XRP from a wallet linked to the Binance breach. Neither recipient has been identified, and available records do not confirm exchange deposits or asset sales.