Binance Hack Funds Move $101M in XRP and Stolen SOL - Bitcoin Foundation
On Nov. 2, someone moved 80 million XRP worth about $100.9 million from a wallet labeled 'Binance hack funds' to two separate addresses, while the attacker was converting stolen Solana to bitcoin through Relay.
Two transactions totaling 80 million XRP, worth approximately $100.9 million, were transferred from a wallet tagged 'Binance Hack 2026' to separate addresses on Nov. 2. The first transaction, worth about $50.46 million, occurred at 03:56 UTC, followed by another valued at $50.44 million just 50 seconds earlier. Whale Alert, which flagged the transfers, noted no evidence of the XRP reaching an exchange or being sold at that time.
Separately, the attacker began converting 970,522 stolen Solana tokens worth about $96 million into bitcoin through the Relay bridge. This activity occurred independently of the XRP transfers. Meanwhile, 18,270 stolen bitcoins valued at approximately $78,053 each remain held across 19 wallets, with no movement since Thursday, though the addresses have received small payments containing messages from strangers.
Binance Breach Response
Following the Oct. 29 security breach that resulted in an estimated $6.3 billion in cryptocurrency losses from hot wallets, Binance temporarily paused withdrawals. On Nov. 1, the exchange announced a phased restart, with the first stage scheduled for 06:00 to 09:00 UTC across 15 networks including XRP Ledger, Bitcoin, Ethereum, BNB Smart Chain and Solana.
By Nov. 1, Binance had replenished about 95% of affected assets, with the remaining 5% consisting primarily of less liquid cryptocurrencies. The exchange confirmed that balances in XRP and several other major assets—BTC, ETH, SOL and BNB—were fully backed. Withdrawals on other networks would resume gradually after security and infrastructure checks.
Tracking Stolen Funds
The reported activity spans multiple networks and services, complicating fund tracking. Analyst SomaXBT traced $140 million in Binance loot through four Tron exit routes, though the analysis focused on assets left unfrozen on Tron without providing transaction-by-transaction details. The FBI has attributed the attack to North Korean operatives, though this is not a court finding identifying a named individual.
Moving funds between wallets is not itself proof of a sale.
Industry Implications
The incident highlights the challenges of tracking stolen cryptocurrency across multiple networks and services. THORChain, which had been used by the attacker to move stolen funds, halted trading on 10 of its 13 chains over the weekend, though this halt is not directly connected to the reported XRP transfers or Relay swap.
The movements demonstrate why security breaches in cryptocurrency exchanges require coordinated responses across multiple blockchain networks and services. Binance customers experienced a phased restoration of withdrawals, with the exchange emphasizing security and infrastructure reviews as prerequisites for resuming operations on all networks.
Related
