Binance Attacker Moves Entire $293 Million in Stolen XRP, Launders $242 Million Through Tron

The attacker behind the Binance hack has moved all stolen XRP into new wallets, on-chain data show. The transfers also indicate parallel laundering activity through the Tron network.

Bitcoin.com reported on November 2 that the attacker began with 1,000-XRP test transfers at 3:47 a.m. UTC from a holding address on the XRP Ledger to six newly created wallets, then completed large transfers within minutes. Whale Alert, an on-chain tracking service, flagged two back-to-back transfers of 40 million XRP each, worth about $50.4 million, from an address labeled "Binance Hack 2026."

The full transaction record shows nine large transfers between 3:52 a.m. and 4 a.m., totaling about 233.45 million XRP. At XRP's current price of $1.26, that amounts to about $293 million. Only 23.7 XRP remained in the original address after the transfers. Five of the six recipient wallets now hold about 40 million XRP each, while the sixth holds about 33.46 million XRP. No further movement of those funds has yet been confirmed.

Blockchain analytics firm Elliptic said the dispersal is likely part of a laundering phase. Splitting funds across multiple wallets increases the number of paths investigators must track and makes it easier to evade exchange deposit blocks by breaking the proceeds into smaller amounts.

Fund flows through the Tron network were also detected. Within two days of the hack, the attacker moved about $242 million through Tron-related routes. Assets stolen on Tron in the attack total about $628 million. After Tether froze about $378.7 million of USDT, the attacker dispersed funds through cross-chain swap protocols including Relay, THORChain, Chainflip and Symbiosis. Another $41.7 million was moved through Bitget Wallet, though the final destination has yet to be identified.

The attacker is also attempting withdrawals through centralized exchanges. Lookonchain, an on-chain analytics account, said the attacker deposited $250,000 into crypto exchange Gate over a 12-hour period. Gate's chief executive officer called for industrywide security coordination shortly after the hack, but has not issued an official statement on the deposit.

U.S. authorities have blamed North Korea for the hack. Binance said it covered about 95% of the losses with its own funds.