It is reported that the hot wallets of Binance exchange that were compromised have been completely emptied. The on-chain tracking service Whale Alert recorded two identical transactions, each transferring 40 million XRP, totaling approximately 101 million US dollars. There was a 50-second interval between the two transactions, and the funds were transferred to a new address.
The report indicates that this address is the corporate address of the platform: rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx. After being attacked on October 29th, the wallet was marked in red in web browsers by the authorities as “Reported as hacked (reported to have been hacked)”.
With the completion of this final transfer, the balance at that address has dropped to 23.7 XRP, which is approximately equivalent to 30 US dollars. In other words, the exchange has transferred all the remaining funds to a new internal wallet.
Why would an exchange empty a wallet that has already been blacklisted?
Reports indicate that this transfer actually signifies the closure of activities at that vulnerable address, and it is also a planned technical consolidation of the remaining balance. The asset transfer occurred following a large-scale cross-chain attack on Binance. The attack began on October 29th and is said to have spanned across 10 different blockchains, with an estimated total loss of $6.3 billion, making it the largest theft in the history of cryptocurrencies.
Reports indicate that hot wallets on XRP Ledger were the first to be affected: within the first 5 minutes of the attack, a total of 233.46 million XRP were transferred out of these wallets, amounting to approximately 296 million US dollars.
Reports indicate that the inherent characteristics of the XRPL network dictate that exchanges must completely clear any blacklisted addresses. Unlike most stablecoins (such as USDT or USDC), whose issuers can forcibly freeze funds, the code of XRP Ledger does not have a freezing function at the protocol level.
The report also states that neither Ripple nor the independent XRP Ledger developers have the technical capability to prevent transactions, therefore leaving any usable balance in the attacked wallets is not secure. Transferring the remaining 80 million XRP coins to a newly isolated wallet on the platform can eliminate the risk of them being withdrawn again.
For the XRP ecosystem, this incident is said to have set a record for the worst in history in every sense. The scale of losses far exceeds that of the hack attack on the Bitget exchange in September; at that time, the exchange lost 103 million XRP, which is approximately 157 million US dollars.
At the same time, reports indicate that there was no panic in the market. Binance has fully resumed customer withdrawal services. The platform management officially stated that all users' net losses will be compensated at a 1:1 ratio by the company's reserve funds and the SAFU fund.
The report concluded that this final transfer of $101 million XRP is likely to indicate that the operations surrounding that hacked account have come to an end, and that the platform's further technical risks have been minimized.
