The compromised hot wallet of the Binance exchange has been completely emptied. Blockchain tracker Whale Alert recorded two identical transactions of 40 million XRP each (around $101 million in total), which went to a new address 50 seconds apart.
This is the platform's corporate address rK21t6nGLy4MNDqhvy3pGwcLFy25qgfzMx. After the October 29 attack, the wallet received an official red "Reported as hacked" label in network explorers.
As a result of this final transfer, the address's balance dropped to 23.7 XRP (around $30) — the exchange fully removed the remaining funds, moving them to new internal wallets.
Why would an exchange empty a wallet that has already been hacked
This transfer effectively closes activity on the vulnerable address and is a planned technical consolidation of the remaining balances. The transfer of assets followed a large-scale cross-chain attack on Binance that began on October 29. Total damage across ten different blockchains is estimated at $6.3 billion, making the incident the largest crypto theft in history.
Hot wallets on the XRP Ledger took the first hit: within five minutes at the start of the attack, a total of 233.46 million XRP (around $296 million) was withdrawn from them.
The specifics of the XRPL network itself oblige the exchange to fully zero out hacked addresses. Unlike most stablecoins (such as USDT or USDC), where issuers can forcibly freeze funds, the XRP Ledger code has no protocol-level blocking function.
Neither Ripple nor independent XRP Ledger developers has no technical ability to stop transactions, so leaving any available balance on a hacked wallet is unsafe. Moving the remaining 80 million XRP to new wallets isolated by the platform eliminates the risk of repeated withdrawals.
For the XRP ecosystem, this incident became an absolute all-time negative record, surpassing the September hack of the Bitget exchange, in which 103 million XRP ($157 million) was lost, multiple times over.
At the same time, no panic has been recorded on the market. Binance has fully restored withdrawal operations for clients. The platform's management officially stated that all net user losses will be compensated 1:1 from corporate reserves and SAFU fund money.
The transfer of the last $101 million in XRP likely puts an end to operations with the hacked address, minimizing further technical risks for the platform.
