Binance's $6.3B Hack: Why One Login Matters for XRP Holders
Binance lost about $6.3 billion after a compromised laptop. Why stablecoins were frozen, why XRP can't be, and what the hack means for self-custody.
Key takeaways
- Binance lost about $6.3 billion in a hack that began late on October 29, 2026, and Binance says it started with one compromised DevOps laptop.
- Tether and Circle froze about $2.4 billion of the hacker's USDT and USDC within hours, and Ripple froze 40.5 million RLUSD. Issuer-controlled stablecoins can be frozen by the company behind them.
- The XRP Ledger's documentation says no one can freeze XRP. That protects holders, but it also means the roughly 233 million XRP reportedly taken from Binance is beyond anyone's freeze.
- The XRP Ledger was not breached. The weak point was the exchange's login, not the ledger.
- Self-custody only works if your family can reach your keys too. A setup only you understand can fail when you are not around.
Binance, the world’s biggest crypto exchange, lost about $6.3 billion in a hack that began late on October 29, 2026. Blockchain analytics firm Elliptic calls it almost certainly the largest known theft of any kind. Binance says the breach started with one compromised DevOps laptop. The XRP Ledger itself was not breached, though the hacker used it to move stolen XRP.
For XRP holders, the hack shows where the risk sits. Stablecoin issuers froze billions of dollars of the hacker’s tokens within hours. XRP on the ledger cannot be frozen. That protects holders, but it also means stolen XRP stays with whoever holds the keys. The video ties this to a wave of attacks on supermarket freezers and asks one question: who has a button over your coins?
What happened in the Binance hack?
The Binance hack drained about $6.3 billion from the exchange, starting late on Thursday, October 29. That is Binance’s own figure. Elliptic puts it slightly higher, at about $6.43 billion, and describes it as the largest theft of anything, not just the largest crypto hack. Analysts have blamed North Korea, and reports say the FBI has attributed the attack to North Korea as well.
Binance’s first findings pointed to a compromised DevOps laptop. DevOps is the engineering team that runs and maintains a company’s systems. The video sums it up as “one laptop, one login, billions gone.” According to the video, Elon Musk reacted that night. Coin Edition reports his post as “Everyday is Zeroday.”
Binance says it will cover losses from its SAFU fund and its own money, and that 95% is already covered. SAFU is an emergency reserve the exchange keeps for events like this. Withdrawals restarted in phases from Sunday, November 1. Bullrunners has more on that pause in why Binance withdrawals froze after the $6.3 billion loss.
What do supermarket freezers have to do with it?
The video links the Binance hack to attacks on refrigeration systems because each one went through a login rather than a physical break-in. Overnight into Monday, November 2, attackers took over supermarket refrigeration controls in at least four European countries.
| Country | What was reported |
|---|---|
| Sweden | An ICA store in Sjöbo said fridges and freezers were set to 50°C; Coop said six stores had problems |
| Ireland | Musgrave, owner of SuperValu, called it a “cyber incident” at 13 stores |
| Belgium and Luxembourg | Delhaize said an IT incident hit refrigeration in several dozen stores |
| France (October 11) | An earlier attack of the same kind hit up to 700 supermarkets; Reuters counted at least 350 |
The video says a Belgian refrigeration contractor reported that the attackers switched cooling units into defrost mode. The control panels sit on the internet so technicians can adjust them remotely. In the French case, panels could be opened with the username “admin” and the current date as the password.
On October 29, Reuters reported that the Pentagon is investigating freezer failures at at least six US military commissaries as a suspected cyberattack. The bases include Fort Huachuca in Arizona and Fort Irwin in California. Those failures happened in August, so they predate the two-week cluster the video describes. The video notes that the Pentagon has not confirmed a break-in or named a cause. Nobody has shown that the US and European incidents share an attacker.
The host also plays a July 2020 clip of Klaus Schwab of the World Economic Forum. Speaking at a cyberattack exercise called Cyber Polygon, Schwab warned that a comprehensive cyberattack could halt power, transport and hospitals. The host says he is not claiming that is what is happening now, and that the culprits could be criminals with a cheap tool and a list of default passwords. Treat that part of the video as speculation, not evidence.
Why were stablecoins frozen after the Binance hack?
Stablecoin issuers froze the hacker’s tokens because their tokens are built to allow it. Within hours, Tether froze more than 1.5 billion USDT and Circle froze more than 800 million USDC, about $2.4 billion between them. Ripple froze 40.5 million of the hacker’s RLUSD. Some outlets give a figure closer to $200 million for Ripple because they also count RLUSD that Ripple blocked inside Binance’s hot wallet.
That is welcome when the target is a thief. The video’s point is that the same button works on anyone. The host gives a smaller example from a different kind of hold: about $1,000 he sent to Coinbase was held for seven days before he could use it. A dollar token that can be frozen for a thief can be frozen for an ordinary customer too. Bullrunners covered the RLUSD side in why Ripple could freeze the hacker’s RLUSD but not XRP.
Can XRP be frozen?
No one can freeze XRP on the XRP Ledger, according to the ledger’s own documentation. That includes Ripple, Binance and governments. Custodial exchanges can still restrict the XRP they hold for customers. On an exchange you hold a balance in the exchange’s system, not coins under your own keys.
This cuts both ways. Bitget was hacked on September 24, and nearly 103 million XRP was moved out and divided among five accounts. Nobody could freeze it on the ledger. Bullrunners’ article on the Bitget hack and why nobody could freeze the stolen XRP walks through that case.
The Binance hack repeats the pattern. Reports say the hacker moved about 233 million XRP out of Binance on the XRP Ledger. Blockchain analytics firm TRM Labs tracked about $296 million in stolen funds moving through the ledger. That XRP is beyond any freeze unless it lands on an exchange that restricts the receiving account. The same rule that lets a thief keep stolen XRP stops anyone from freezing XRP in your own wallet.
Was the XRP Ledger hacked?
The XRP Ledger was not hacked; Binance was. According to the video, the ledger kept confirming new batches of transactions every few seconds through the night. The stolen XRP moved across the ledger because the attacker controlled Binance’s keys, not because the ledger’s rules were broken.
The video draws the line this way: the freezers had a login, the military bases had a login and the exchange had a login. The XRP Ledger runs on rules that anyone can check, and it has been running since 2012. What attackers broke into were passwords, control panels, laptops and people. The host argues that because the ledger was built to do one job, move value, it has fewer doors to attack. If your coins sat in a Binance hot wallet, your safety came down to one engineer’s laptop.
How did XRP and the market react to the Binance hack?
The video argues that markets absorbed the hack without the broad sell-off seen in earlier years. It lists what else markets took in over a short period:
- The Fed raised rates in September, its first hike since 2023. It held on October 28, with two officials, Lisa Cook and Beth Hammack, voting to raise again.
- Oil rose, which the video links to a war in Iran.
- Alphabet had its worst day on record on October 29, down about 13%.
- Intel fell close to 29% the next day, its worst day since 1974.
The video puts XRP at about $1.28 and Bitcoin at around $78,000 at the time of recording. XRP did slip. Reports after the hack had it near $1.24 to $1.25, and one said it fell 3% in 24 hours. The host contrasts this with 2014, when there was no BlackRock in crypto and no banks selling it to customers. He argues that each attack now pushes more money into securing exchanges, wallets and logins. That is the host’s interpretation, not a measured cause.
A simple check: whose login guards your coins?
The video does not lay out a numbered plan, but its main lesson can be turned into a short check. The steps below are Bullrunners’ summary, not the host’s.
- List every place you hold crypto. Mark which holdings are on an exchange, where someone else controls the login, and which are in a wallet where you hold the keys.
- If you hold issuer-controlled stablecoins such as USDT, USDC or RLUSD, remember that the issuer can freeze them.
- For self-custody, the host’s approach is to keep keys on a device you hold and write the backup down somewhere only you and your family know.
- Check that your family can actually reach those keys. The host’s warning: a setup only you understand is a lock nobody can open when you are not around. Bullrunners’ guide to what happens to self-custodied XRP when you die covers this step.
What to watch next
Watch whether Binance covers the remaining losses beyond the 95% it says it has paid. Watch whether any frozen USDT, USDC or RLUSD is returned. Watch where the roughly 233 million stolen XRP moves next, and whether any exchange that receives it restricts the accounts. On the freezer attacks, look for the Pentagon to confirm or rule out a cyberattack, and for any official link between the US and European incidents. Until then, the video’s core question is worth answering for your own holdings: who has a button over your coins?
Sources
- Supermarket freezer attacks, November 2, 2026 (ABC News/AP)
- 2026 French supermarket refrigerator hack (Wikipedia)
- Pentagon investigating military base freezer failures (The Next Web)
- Binance: the largest hack in history (Elliptic)
- Binance hack and customer funds (CNBC)
- Elon Musk reacts to the Binance breach (Coin Edition)
- XRP Ledger documentation: Freezing Tokens
- Bitget security update, September 25, 2026
- Federal Reserve October 28, 2026 decision (CNN)
Frequently asked questions
How much did Binance lose in the October 2026 hack?
About $6.3 billion by Binance's own figure. Elliptic puts it at about $6.43 billion and calls it almost certainly the largest known theft of any kind. Analysts have blamed North Korea, and reports say the FBI has too.
How did the Binance hack start?
Binance's first findings pointed to a compromised DevOps laptop, a machine used by the engineers who run its systems. The video describes it as one laptop and one login leading to billions in losses.
Did Binance customers lose their money?
Binance says it will cover losses from its SAFU emergency fund and its own money, and that 95% is already covered. Withdrawals restarted in phases from Sunday, November 1.
Can XRP be frozen like USDT, USDC or RLUSD?
The XRP Ledger's documentation says no one can freeze XRP on the ledger. Stablecoin issuers can freeze their tokens, and custodial exchanges can restrict the XRP they hold for customers.
Was the XRP Ledger hacked during the Binance attack?
No. Binance was breached, not the XRP Ledger, and the video says the ledger kept running through the night. Reports say the hacker did move about 233 million XRP taken from Binance across the ledger, where it cannot be frozen.
Full video transcript
From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.
Overnight into Monday, November 2nd, somebody logged into supermarket freezers in at least four European countries and turned them into ovens. In Sweden, one store's fridges and freezers were set to 50° C. That's over 120° F. In Ireland, 13 SuperValu stores. In Belgium, Delhaize says several dozen stores.
A week earlier, Reuters reported the Pentagon is treating freezer failures at six US military bases as a suspected cyberattack. And in between, Binance, the biggest crypto exchange in the world, lost about $6.3 billion in a single night. Freezers, army bases, the biggest exchange on Earth, all in the same 2 weeks. So, in this video, I'm going to show you what all three have in common. Why the one thing that did not get broken into that night was the XRP Ledger.
And the one door used to still have to lock yourself. Let's get into it. Here's what happened. In Sweden, an ICA store in Sjöbo said its fridges and freezers had been set to 50° and staff were throwing food out. Coop said six of its stores had problems.
In Ireland, Musgrave, the company that owns SuperValu, called it a cyber incident in 13 stores. In Belgium and Luxembourg, Delhaize said an IT incident hit refrigeration in several dozen stores. One Belgian refrigeration contractor said the attackers switched the cooling units into defrost mode. And this isn't the first round. On October 11th, the same kind of attack hit up to seven other supermarkets in France.
So, how do you attack a freezer? You don't break in. These cold aisles are run by control panels that sit on the internet so a technician can adjust them remotely. And in the French attack, a lot of those panels could reportedly be opened with the username admin and the dates as the password. Whoever did this didn't need a crowbar, they needed a login.
Hold on to that word, login. It's going to come back three times in this video. On October 29th, Reuters reported that the Pentagon is investigating freezer failures at US military commissaries as a suspected cyber attack. At least six bases, including Fort Huachuca in Arizona and Fort Irwin in California. US Cyber Command is involved, so is Army Criminal Investigation.
Now, to be fair, the Pentagon has not confirmed anybody got in. It has not named a cause and nobody has proved the US bases and the European stores are the same attacker. But think about what's being tested here. Not a bank, not a power plant, the food. And governments are acting like they know something.
By the count, several outlets are running, 33 countries are now telling their citizens to keep food, water, and supplies at home. Japan's new guidance started this week, at least 3 days, ideally a week. Is some of this just normal emergency planning? Yes. A lot of those campaigners are years old, but it's the first time I've ever seen this many of them in a single week in the news as the freezers.
If this feels a little like early 2020, there's a reason. In July of 2020, in the middle of the first pandemic, Klaus Schwab of the World Economic Forum opened a cyber attack exercise called Cyber Polygon with a warning.
We all know, but still pay insufficient attention to the frightening scenario of a comprehensive cyber attack, which would bring to a complete halt to the power supply, transportation, hospital services, our society as a whole. The COVID-19 crisis would be seen in this respect as a small disturbance in comparison to a major cyber attack.
He said a comprehensive cyber attack could bring power, transport, and hospitals to a complete halt. And that COVID-19 would look like a small disturbance next to it. I'm not saying that's what this is. Maybe it's criminals with a cheap tool and a list of default passwords. Maybe it's a country testing how fast the West food supply cracks.
Nobody knows yet. But I'll tell you what I do know. Every one of these attacks went through a login, and the next one will go through a login, too. Working out which of your coins sit behind somebody else's login, and which ones only you can move, is the exact thing that we map out with our clients inside of SGS system at Altcoin Pro. If you've never had anybody walk through it with you, the first link in the description is there.
Get yours looked at this week. On October 29th, an attacker drained about 6.3 billion dollars from Binance. Elliptic, the blockchain analytics firm, calls it the largest theft in history. Not the largest crypto hack, the largest theft of anything. They think North Korea's behind it.
And here's how it started. Binance says a compromised DevSecOps engineers laptop, one laptop, one login, billions gone. The night it happened, Elon Musk posted three words, "Every day is zero day." Now, Binance says it will cover every loss from its Safu fund and its own money. And it says it has already covered 95%. Withdrawals came back in phases over the weekend.
So, if you had money there, that's definitely good news. But there are two lessons in this, and they're the whole reason why I made this video. Within hours, Tether froze more than 1.5 billion dollars of its dollar coins. Circle froze more than 800 million. That's about 2.4 billion dollars locked with the push of a button.
And Ripple froze the hackers RLUSD, around 40 million of it got stuck. That's great when it's a thief, but think about that one time where you sent money and it got frozen or stopped or locked. For example, I sent some on-ramp money to Coinbase recently, and I couldn't get my funds for 7 days. It was only $1,000, and they locked it for 7 days because they were waiting for it to mature. I guess that's now part of the on-ramping extra crypto, but it is such a pain.
But a dollar that can be frozen for a thief can be frozen for anyone with the same butt. Now, here's what nobody could freeze. The XRP ledger's own documentation says it plainly. No one can freeze XRP in the XRP ledger. Not Ripple, not Binance, not a government, nobody.
Now, that cuts both ways cuz in September Bitget got hacked, and about 103 million XRP left its wallets. Nobody could stop it. It was moved onto five new accounts before midnight. It's frustrating when the thief has it, but that is the exact same property that protects your XRP, and when you hold the keys, you don't get one without the other. The XRP ledger didn't get hacked, and exchanged it.
The ledger kept closing every few seconds the whole night. Binance's own biggest XRP wallets didn't send a single million XRP payment while the hack was going on. But if your coins were sitting in a Binance hot wallet, your safety came down to one engineer's laptop. That's the line. The freezer had a login.
The army base had a login. The exchange had a login. The XRP ledger has rules, math anybody can check running since 2012. So, why does the market not panic the way it used to? Look at what it just absorbed.
The Fed raised rates in September, the first hike since 2023. With a war in Iran pushing oil up on October 28th, it held, but two officials voted to raise again. Alphabet had the worst day in its history on October 29th, down about 13%. The next day, Intel had its worst day since 1974, down close to 29%, and the biggest exchange hack ever. And XRP is sitting at about a dollar 28.
Bitcoin's around $78,000. There was a time a hack that size would have dragged the whole market down with it. In 2014, there was no BlackRock in crypto, no banks selling it to customers. Now, the biggest names in finance have skin in the game. So, every attack like this pushes more money into securing everything around the ledger.
The exchanges, the wallets, the logins. I know what you're thinking. Ryan, if AI can get into Binance, it can get into the XRP ledger, too. And here's the difference. A lot of people watching AI break into freezers and exchanges assume crypto has to be next.
But, look at what's actually getting broken into. Passwords, control panels, laptops, people. The XRP ledger was built to do one job, move value, and it has kept it simple on purpose. The simpler the system, the fewer doors there are to kick in. Banks and exchanges are the ultimate honeypot.
One system, millions of accounts, one door. Self-custody takes that door away. Your keys on a device that you hold, written down somewhere only your family knows. And make sure your family can actually get to it. A security setup only you understand isn't security.
It's a lock that nobody can open when you're not around. So, here's my take. Fear is a terrible place to make money decisions from. Stop doomscrolling. Go outside, know your neighbors, keep a week of water, food, and cash at home because that costs you almost nothing.
And for the long run, keep the money you're saving somewhere no login can reach. Stock the pantry for a week. Hold your own keys for the next 10 years. So, tell me in the comment section, after the last 2 weeks, who do you trust more with your money? A bank, an exchange, or your own keys?
Just one word down below. Bank, exchange, or my keys. Everything in this video is on the public record. The freezers had a login, Binance had a login, the XRP ledger has rules. If you want somebody to walk you through where your coins actually sit and who has a button over them, well, that's what we do with our clients inside the SGS system at Altcoin Pro.
And it's for people holding $50,000 or more in crypto who've never had anybody check it with them. If you're not there yet, keep watching these, they're free. If your spouse has a say in where the money goes, bring them onto the call with you. The first link in the description gets you started. And crypto carries risk and past performance doesn't guarantee future results.
This is education, not financial advice. You know what to do. Stay bullish. I'll see you at the top.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on November 5, 2026 and may have changed since.
