How much XRP did the Binance hack take?

On Oct. 29, 2026, an attacker drained Binance's hot wallets, the online wallets an exchange keeps to process withdrawals. As of 00:30 UTC on Oct. 30, TRM Labs counted more than 420,000 ETH and 18,270 BTC in the attacker's hands, about $2.4 billion beyond any issuer's reach. Binance has pledged to cover the whole loss, which it preliminarily estimates at about $6.3 billion. For customers, the stake is whether the money behind that pledge exists and when withdrawals reopen.

The pledge, in a statement shared with BleepingComputer, names two pots: company funds and SAFU, short for Secure Asset Fund for Users, Binance's own reserve for user losses. Founder Changpeng Zhao, known as CZ, ran rough numbers in a reply on X on Oct. 30, relayed by Decrypt. He wrote of a "$6.x b hack, $3b frozen, $1.x b SAFU fund." By his rounding, that leaves a gap of about $2 billion, which he called manageable with other company assets.

The fund's size is unconfirmed beyond CZ's rounding, and the updated Proof of Reserves Binance has promised after remediation carries no date. Binance's 04:36 UTC post on Oct. 30, quoted by the tracker PublicAML, kept withdrawals paused for a security revamp of the withdrawal service and its related addresses. Binance expected withdrawals back within 48 hours of that post. PublicAML also quotes an 08:47 UTC update putting them on track to resume in 45 hours.

TRM counts about 42% of the stolen sum as frozen

TRM counted about $2.7 billion frozen at the same 00:30 UTC mark. Stablecoins make up about $2.67 billion of it, blocked by Tether, Circle, Ripple and World Liberty Financial. Arbitrum's Security Council moved roughly $30 million more in ETH and ARB out of the attacker's reach.

Frozen means an issuer has locked tokens at an address so they cannot move; getting them back is a separate step. Against the roughly $6.36 billion TRM traced as of that time, the frozen sum comes to about 42%.

ETH and BTC have no issuer that could lock them. To outrun stablecoin freezes, the attacker swapped about $325 million in USDT for ETH worth about $285 million in the first hours of Oct. 29, TRM and Chainalysis report. That discount of more than 10% cost the attacker roughly $40 million.

The theft reached the XRP Ledger as well. Between 20:05 and 20:09 UTC on Oct. 29, five Binance wallets sent 233.46 million XRP to a single attacker address. By TRM's valuation, that was about $296 million at transfer-time prices. PublicAML's on-chain checks found the XRP still at that address on the morning of Oct. 30.

XRP works like ETH and BTC here, with no issuer to block it. RLUSD, Ripple's dollar stablecoin, has an issuer, and Ripple is one of the four issuers behind the roughly $2.67 billion in frozen stablecoins TRM counts.

Binance's frozen count runs above TRM's

CZ's "$3b" frozen is his own rounding. Binance first put the verified frozen total at $2.54 billion late on Oct. 29, then at around $3 billion on Oct. 30, with no breakdown. TRM's $2.7 billion at 00:30 UTC sits about $300 million lower.

Chainalysis reported about $2.8 billion frozen so far, in an undated post that gives no reference time. That count stands on its own beside TRM's and Binance's and is never added to them.

The loss counts diverge as well. Binance's $6.3 billion estimate sits beside TRM's $6.36 billion, which values each transfer at the moment it was taken across 10 blockchains. At prices current when TRM published on Oct. 30, the same assets were worth about $6.23 billion. Chainalysis puts the unauthorized transfers at about $6.4 billion and states no valuation method.

Binance and TRM tell different break-in stories

Binance's preliminary account pointed to one machine. A compromised DevOps engineer's laptop may have let an attacker reach a service container and submit unauthorized withdrawals. Binance reported no evidence that a wallet private key leaked.

Binance has since widened that picture. Co-CEO Richard Teng described a more complex process than one engineer's permissions or a single one-click action. Binance's investigation has attributed responsibility to no individual, he added. In an 08:47 UTC update on Oct. 30, Binance reported additional points of breach beyond the laptop, which it has yet to identify.

TRM offers a different explanation. In its assessment, the attacker most likely gained the ability to make Binance's hot-wallet signing system sign transactions across chains.

The Ethereum leg shows the mechanics. At 20:20 UTC on Oct. 29, the attacker sent one EIP-7702 transaction carrying 50 pre-signed authorizations. EIP-7702 is an Ethereum feature that lets an ordinary wallet run contract code it has authorized. One authorization took effect, and a Binance hot wallet began running a sweeper contract only the attacker could call.

For customers, three documents mark the next steps: a Binance notice that withdrawals have resumed, the technical post-mortem that PublicAML reports Binance has promised, and the updated Proof of Reserves.