Binance Hack First Drained XRP, With $296 Million Moved Out in 4 Minutes

XRP was the first asset stolen in the $6.3 billion hack of global cryptocurrency exchange Binance.

Bitcoin.com reported on Nov. 1 that blockchain analytics firm TRM Labs, after tracing the Oct. 29 Binance hack, found the attackers first siphoned off about $296 million worth of assets on the XRP network.

TRM Labs said the attackers transferred a total of 233.46 million XRP from five Binance wallets to a single wallet address between 8:05 p.m. and 8:09 p.m. UTC on Oct. 29. About 79% of the stolen amount moved in the first transaction, and the affected wallets were left with only the minimum balances required to remain active.

On-chain analytics firm Glassnode also identified XRP as the first asset to leave the exchange, followed by Solana, Bitcoin, Ether, Tether and Tron. According to Arkham, the attackers later moved an additional $6 billion through 141 transactions across nine blockchains.

Ripple, which issues XRP, froze part of its dollar-pegged stablecoin RLUSD to limit further damage. After the attackers had already sold 48 million of the 88.5 million RLUSD they stole, Ripple blocked movement of the remaining 40.5 million RLUSD on the Ethereum network.

XRP, unlike RLUSD, does not have an issuer freeze function, making recovery more difficult. Blockchain analytics firm Elliptic said the stolen XRP remained in the attackers' wallet without further movement as of 5 a.m. UTC on Oct. 31.

Binance said that as of Oct. 31 it had covered about 90% of the total assets lost in the hack. Customer balances for 10 cryptocurrencies, including XRP, Bitcoin and Ether, were fully secured, and the exchange plans to complete a zero-knowledge proof, or ZKP, of reserves for those assets by Nov. 3.