Binance drain, the XRP leg: how 233 million XRP was split up and fed into THORChain to be swapped into Bitcoin

1. What happened

On 29 October 2026, assets were drained from several of Binance's "hot wallets" (the online wallets an exchange uses for day-to-day withdrawals). On 31 October the FBI issued an alert attributing the attack to North Korea (FBI alert).

The losses span many chains. This article covers the XRP Ledger (the blockchain that records the XRP crypto asset). On-chain, five of Binance's XRP hot wallets sent 233,461,943 XRP in total to one account over four minutes, from 20:05 to 20:09 UTC on 29 October.

Like Bitcoin, XRP is a currency that no issuer can freeze. Unlike stablecoins such as USDC or USDT, there is no issuer to ask to stop the funds after a theft. That is exactly why knowing quickly where they move matters.

2. A few terms first

• XRP Ledger accounts: On the XRP Ledger, money sits in "accounts", much like a bank account number. Creating one requires keeping a set amount of XRP in it (the reserve). This article simply calls them accounts.
• Destination tag: A number attached to a payment. Exchanges and swap services share one deposit account among many users and use this number to tell whose deposit it is, like a customer reference number on a bank transfer to a shared account. Destinations that receive many tagged payments are almost always deposit points of exchanges or swap services.
• THORChain and swap memos: THORChain lets people swap assets on different chains, such as Bitcoin, Ethereum and XRP, directly without going through an exchange (a cross-chain swap). The user sends XRP to an account controlled by THORChain (a vault) and attaches a "memo" to the payment saying what to swap into and where to send it. Almost all memos in this case said "swap to Bitcoin and send to this Bitcoin address".
• Refund: On THORChain, an order can carry a condition such as "I want to receive at least this much". If the market moves and the condition cannot be met, or the order is not accepted, the funds are sent back to the sender without a swap (minus fees). That is a refund.

3. Following the money in order

All times are UTC.

1. 29 October, 20:05–20:09 233,461,943 XRP arrives in one attacker account from five Binance hot wallets.
2. 2 November That account splits its balance into six accounts: five with about 40 million XRP each and one with about 33.46 million XRP.
3. From 14:56 on 5 November One of the six accounts collects the balances of two others and scatters about 103 million XRP to 49 relay accounts.
4. The 49 relay accounts send on to 72 further accounts. As of the morning of 8 November (UTC), the incident page's chart shows 124 relay accounts in total.
5. The relay accounts send XRP to THORChain's vault. Almost every memo says "swap to Bitcoin and send to this address".
6. Orders whose conditions cannot be met are refunded, and the returned XRP is sent again as a new order.

A single large account stands out and is hard to swap from, so the funds are cut into small pieces made to look like many separate "users" and fed into THORChain a little at a time.

4. Where did the funds go?

As of the morning of 8 November (UTC), the 233,461,943 stolen XRP breaks down as follows (the same figures as the "Where the funds are" chart on the incident page).

Broken down, the dealings with THORChain look like this (5 November to the morning of 8 November, UTC).

Refunds came to about 40% of what was sent. The same money is sent and returned again and again, so simply adding up "amount sent" overstates the flow. We count the net amount after refunds.

Of what has not moved yet, about 113 million XRP is still sitting in three accounts (as of the morning of 8 November, UTC). We cannot know when it will move, but if it does, we will know right away (see the next section).

5. What ChainAnalyzer now follows

On 8 November we added the following.

• Watching every attacker account's balance: For every XRP account registered to the incident, the balance is checked regularly and any decrease is reported within minutes. Receiving accounts are added to the incident record automatically, and for payments to THORChain, the Bitcoin (or other) destination written in the memo is added too.
• Visible in the charts: The XRP flow now appears in the incident page's network graph and in the "Where the funds are" chart (a Sankey diagram where band width shows the amount still held and the amount that left through each exit).
• THORChain destinations registered: From the swap memos we extracted Bitcoin, Ethereum and TRON destinations (55 as of the morning of 8 November, UTC) and added them to the incident record.
• Reflected in wallet scans: The attacker accounts and the destinations are registered in ScamDB (our database of malicious addresses). On every plan, wallet scans, the REST API and MCP flag transactions that touch these addresses.

閉じる / Close

閉じる / Close

The recipients of tagged payments and THORChain's vaults themselves are not the attacker (many other users' money passes through them too). So that unrelated businesses and users are never marked as recipients of stolen funds, they are not registered as malicious addresses.

6. How we checked

• We confirmed each transfer from Binance's hot wallets to the attacker account against the XRP Ledger, and checked that the total matches the figure in Binance's preliminary report.
• At every split and relay step, we took the sender, recipient and amount from on-chain records and summed them per account.
• Payments to THORChain and refunds were matched one by one for each account and counted net of refunds. A payment is treated as a refund if it came back from a THORChain vault to the sender.
• We checked that the four destinations in "Where the funds are" (held, THORChain, tagged payments, moved downstream) add up exactly to the 233,461,943 stolen XRP.
• For the funds that have not moved, we read each account's current balance directly from the XRP Ledger.

7. Closing: tracing a currency nobody can freeze

Because no issuer can freeze XRP, all that can be done after a theft is to report quickly where it moved. Here, the funds were fed into THORChain a little at a time from many small accounts, to be swapped into Bitcoin and moved to another chain. The destination Bitcoin addresses are written in the memos, so following the records shows where the money is headed. We put those addresses into the incident record and ScamDB, so that exchanges and swap services can notice when they receive a deposit from them.

We will keep watching where the roughly 113 million XRP that has not moved yet goes from here.

The flow of funds on Solana in the same incident is covered in a separate article on the Solana leg.