Ripple Froze the Binance Hacker's RLUSD: Why XRP Can't Be Frozen
Ripple froze 40.5 million RLUSD after the Binance hack, but 48 million got out first, and stolen XRP could not be frozen. What it means for exchange custody.
Key takeaways
- Ripple paused the Binance hacker's wallet at 22:00:59 UTC on October 29, 2026, freezing 40,541,065 RLUSD, but 48 million RLUSD had already been swapped away.
- A regulated stablecoin like RLUSD can be frozen by its issuer. XRP on the XRP Ledger cannot be frozen by anyone, according to the ledger's own documentation.
- The video said Binance's XRP did not move, but TRM Labs counted 233.46 million XRP (about $296 million) taken from Binance wallets, and no one could freeze it on the ledger.
- If your XRP is on an exchange, the exchange can freeze it. Binance suspended deposits and withdrawals after the hack and has since said they are resuming in phases.
- Early hack numbers often conflict. Check the company's own later statements and the on-chain record before trusting a headline figure.
Ripple froze the Binance hacker’s RLUSD stablecoin at 22:00:59 UTC on October 29, 2026, locking 40,541,065 RLUSD in place after 48 million had already been swapped into other coins. XRP works differently. The XRP Ledger’s documentation says no one can freeze XRP, so the XRP taken from Binance in the same hack could not be stopped that way.
For XRP holders, the Binance hack shows who holds which button. A freeze stopped about $40 million from leaving with a thief, and it also showed that somebody controls that switch. The video, presented by Ryan Huggins, walks through the public record to ask who can freeze what. It also says Binance’s own XRP did not move that night. Outside reports say otherwise, and this article covers both below.
What happened in the Binance hack?
Binance was hacked on October 29, 2026, and suspended deposits and withdrawals across the exchange. According to the video, Binance said at 21:29 UTC that it was aware of reports of a potential security issue and that user funds were safe. About an hour later, withdrawals were paused. At 23:22 UTC, the video says, Binance put the verified total frozen at $2.54 billion, describing it as frozen, not lost.
At 02:25 UTC on October 30, Binance estimated the total impact at around $6.3 billion. It said it would cover losses from its SAFU fund, company funds and part of its futures insurance fund. SAFU is an emergency reserve Binance set up in 2018 to protect users in a hack. Binance later said about $3 billion had been frozen. The video also says Binance co-founder CZ, who no longer runs the company, wrote that he expected user funds to be covered. We covered the exchange’s response in more detail in who pays for the $6.3 billion Binance hack.
The numbers that circulated that night did not agree. The video opens with two YouTubers citing $5.6 billion and $2.7 billion within the same hour. The host notes that the larger figure was someone’s count of what moved, not a number Binance had given at the time. Binance has since published its own estimate.
Who froze the stolen dollar coins?
The companies behind stablecoins froze the stolen funds they could reach. According to the video, Tether froze more than $1.5 billion of its dollar coin and Circle froze more than $800 million of its own. Ripple’s RLUSD has the same ability. A stablecoin has a company behind it, and that company can lock any wallet holding the coin.
The day before the hack, Ripple CEO Brad Garlinghouse spoke at Ripple’s own conference in New York. He called RLUSD “the gold standard from a regulatory point of view.” He pointed to news from the OCC, Ripple’s work with the New York DFS and a new Moody’s rating, which he described as the highest safety rating of any stablecoin. Moody’s rated RLUSD A2 for the long term and P-1 for the short term. He also said that technologies have been used by bad actors throughout history and that this will continue.
As the video puts it, a regulated dollar coin is one its company can freeze. For background on how those controls work, see Ripple’s freeze and clawback settings for RLUSD.
How the RLUSD moved: the timeline
Every RLUSD transfer is public on Ethereum, down to the second. The video traced the sequence on Etherscan:
- 20:24 UTC: Two Binance wallets sent out RLUSD 24 seconds apart, 62.6 million from one and 25.9 million from the other, for 88.5 million in total.
- Next: The RLUSD hopped through three wallets.
- 21:33 UTC: All of it landed in one wallet, the hacker’s.
- 21:42 UTC: The hacker began selling into Curve and Uniswap trading pools. These are automated programs that swap one coin for another without asking questions. RLUSD went in, Tether’s and Circle’s coins came out, and those coins were sent on to other wallets.
- 22:00:59 UTC: A transaction with two signatures hit the RLUSD contract with one instruction: pause the wallet. The video says the hacker’s last sale went through in the same block as the freeze, within the same 12 seconds.
- 22:08 UTC: Jack McDonald, Ripple’s SVP of Stablecoins, posted that Ripple was “actively freezing affected funds.” The freeze was already done.
- 22:20 UTC: According to the video, Ripple froze one more wallet. It was Binance’s own wallet, the one the 62.6 million had come from.
The final tally: 88.5 million RLUSD left Binance, 48 million was traded away, and 40.5 million was frozen. That means Ripple caught about 46% of its coin.
Is the 48 million RLUSD gone for good?
The video says not necessarily. The 48 million was swapped into other dollar coins, including Tether’s and Circle’s, and by the video’s figures those two companies froze about $2.3 billion combined that night. The host says he did not trace every hop and does not say where the money ended up. The frozen 40.5 million is also not the same as returned. What Ripple does with it is still open.
Can Ripple freeze XRP?
No. The XRP Ledger’s documentation states that no one can freeze XRP on the ledger. Its next sentence matters just as much: custodial exchanges can always freeze the funds they hold for customers, at their own discretion.
The video checked Binance’s XRP. It says XRPScan labels 160 XRP Ledger wallets as Binance’s, holding about 2.55 billion XRP together. None of the 25 largest sent a payment of 1 million XRP or more on the night of the hack. From that, the video concluded that Binance’s XRP did not move.
That conclusion is wrong. Blockchain analytics firm TRM Labs counted 233.46 million XRP, about $296 million, taken from Binance wallets. Bitcoin.com reported that five Binance wallets sent the XRP to a single attacker address in about four minutes, starting at 20:05 UTC. That was about 20 minutes before the RLUSD left. Reports also say the XRP Ledger was the first chain hit. The video’s check covered only the 25 largest of the 160 labelled wallets. Because no one can freeze XRP, there was no button for anyone to press on that stolen XRP.
The video also says Binance’s system listed XRP withdrawals on the XRP Ledger as switched off. The video includes a 2019 clip of Andreas M. Antonopoulos explaining that exchanges keep control of the keys, so a balance on an exchange is “a promise from the exchange.” On the XRP Ledger, an exchange holds customer XRP in wallets it controls. Your balance is an entry in its database: a claim on the exchange, not coins on the ledger. The video put XRP at $1.20 when the host checked, down about 9% in a day, though other outlets reported different daily moves.
The other side: the Bitget hack nobody could freeze
No one can freeze XRP, and that cuts both ways. On September 24, 2026, hackers hit Bitget, which now says $387.5 million was taken, up from its first estimate of $351.6 million. Part of it was XRP. The video says Bitget published the hacker’s XRP address.
According to the video, that account took in 102,976,680 XRP from Bitget’s wallets. Before midnight UTC it had pushed all of it into five new accounts, which held about 27 XRP between them by October 30. Bitquery, another analytics firm, traced the XRP through 233 new accounts, ending in six that held about 30 XRP by September 27. The video values the XRP at about $124 million at the October 30 price of $1.20. TRM Labs put it at about $158 million at the time of the theft. Either way, nobody could freeze it. The full story is in how 103 million XRP was stolen from Bitget.
Who holds the freeze button?
The trade-off comes down to where your coins sit and who controls them.
| Asset and location | Can it be frozen? | Who holds the button |
|---|---|---|
| RLUSD (or another regulated stablecoin) | Yes | The issuer, such as Ripple |
| XRP in your own wallet on the XRP Ledger | No | No one |
| XRP held on an exchange | Yes, in practice | The exchange |
The video frames it this way: you can have a chain where somebody can freeze a thief, or one where nobody can freeze you, but not both. The host notes that the freeze function is one reason banks and large corporations may prefer stablecoins. Individual holders who want coins that cannot be frozen take on the job of securing them themselves. A clip in the video sums it up: anyone holding XRP because no government can touch it has to accept that nobody can touch it when it is stolen, either. The XRP taken from Binance and Bitget shows that side of the bargain.
What to watch next
Some of the questions the video raised have since been answered. Binance put the total impact at about $6.3 billion, with about $3 billion frozen. It has said withdrawals are resuming in phases and that 90% of affected assets are covered. Points still worth following:
- Whether Binance completes coverage for the remaining affected assets, and when XRP Ledger withdrawals in particular fully reopen.
- What Ripple does with the 40.5 million RLUSD it froze, since frozen is not the same as returned.
- Where the 233.46 million XRP taken from Binance moves next. On the ledger it cannot be frozen, but any of it sent to a custodial exchange could be frozen by that exchange.
Sources
- RLUSD contract, every transfer (Etherscan)
- The freeze transaction, 22:00:59 UTC, October 29, 2026 (Etherscan)
- Binance on X: hack estimate, October 30, 2026
- Binance on X: first statement, October 29, 2026
- Jack McDonald (Ripple) on X, October 29, 2026
- XRP Ledger documentation: Freezing Tokens
- Bitget security update, September 25, 2026
- Bitget hacker’s XRP account (XRPSCAN)
Frequently asked questions
Can Ripple freeze XRP?
No. The XRP Ledger's documentation says no one can freeze XRP on the ledger. It also says custodial exchanges can freeze the funds they hold for customers at their own discretion.
How much RLUSD did Ripple freeze after the Binance hack?
According to the on-chain record cited in the video, 40,541,065 RLUSD was frozen in the hacker's wallet. Exactly 48 million RLUSD had already been swapped out, so Ripple caught about 46% of the 88.5 million that left Binance.
How much did Binance lose in the October 2026 hack?
Early figures conflicted. Two YouTubers cited $5.6 billion and $2.7 billion, and the video says Binance first put the verified total frozen at $2.54 billion. Binance later estimated the total impact at around $6.3 billion, said about $3 billion was frozen, and said it would cover losses from its SAFU fund, company funds and part of its futures insurance fund.
Was Binance's XRP stolen in the hack?
Yes, according to outside reports. The video said Binance's largest XRP wallets did not move, but TRM Labs counted 233.46 million XRP, about $296 million, taken from Binance wallets, and Bitcoin.com reported that five Binance wallets sent it to one attacker address starting at 20:05 UTC.
Why could nobody freeze the XRP stolen from Bitget?
XRP itself has no freeze function. In the September 24, 2026 Bitget hack, about 103 million XRP was taken. The video says it was pushed into five new accounts holding about 27 XRP by October 30, while blockchain analytics firm Bitquery traced it through 233 new accounts.
Full video transcript
From the video's captions, lightly formatted. Captions can mishear names and numbers, so check figures against the article above.
Now, listen to Binance. 5.6 billion. That's five times more than the Bybit hack. So, breaking news, it looks like Binance just got hacked for 2.7 billion dollars. And if this is true, and it seems to be true, because there is no official confirmation from Binance.
Two YouTubers, the same hour, two different numbers. Binance hasn't confirmed either one. But, here's a number I can show you because it's on the public record anyone can read. At 10:00 p.m. UTC on October 29th, 2026, Ripple froze the Binance hacker's wallet.
40 million RLUSD, Ripple's dollar coin, stuck where it sat. But, 48 million had already been traded away in the 18 minutes before the freeze. And all of it had left Binance's wallets only an hour and a half earlier. If you hold XRP on an exchange, this one is about your money. Because a freeze button just did two things at once.
It stopped 40 million dollars from leaving with a thief, and it reminded everybody that somebody's holding the button. So, here's the question for the rest of us. Who can freeze what? And where does your XRP sit when they do? So, if you're feeling bullish, like this video, and smash that subscribe button.
We're on our way to 400,000 subscribers, and we can't get there without you. And if you're going to become the very first millionaire in your family tree, confirm that by commenting 777 down below. Also, I'm going to go ahead and give away my 2026 altcoin trading strategies and crypto yield generation briefing to everyone for free who follows us on Instagram. Head over there @bullrunnershq, @bullrunnershq. The official link is actually in the description if that makes it easy for you.
So, let's go ahead and get that going, and let's run it. All right, bull runners. I'm Ryan Huggins, aka @winwithryan. Welcome back to the channel. Start with the day before.
On October 28th, Ripple CEO was on stage at Ripple's own conference in New York. And he was talking about crypto's reputation.
You know, I can understand why people might not be excited about how technologies are used. And many technologies in the history of time have been used in ways that uh by bad actors. And that frankly will continue to happen.
The next day, it did. Here's what Binance has actually said in its own words. At 9:29 p.m. UTC on October 29th, it was aware of reports of a potential security issue. User funds are completely safe.
An hour later, withdrawals paused. Then at 11:22 p.m., Binance said the verified total frozen is 2.54 billion dollars. Frozen, not lost. CZ, who founded Binance and doesn't run it anymore, wrote that he expects all of user funds to be covered. So, the 5.7 billion dollars in the headline is somebody's count of what moved, not a number Binance has assigned.
So, who got the money back? The dollar coins. Tether froze more than 1.5 billion dollars of its dollar coin. Circle froze more than 800 million of its own. And dollar coins like these have a company behind them.
And that company can lock a wallet that holds them. Ripple has one, too, RLUSD. And the day before this hack, here's how Ripple CEO sold it.
Look, I think the core thing from the beginning, Ripple has always been focused on the institutional use case. We've really leaned into regulation. And and I think RLUSD is really the gold standard from a regulatory point of view. The OCC news earlier this week is an example of that. Our work with the New York DFS is an example of that.
And just yesterday with a Moody's rating of you know, the the kind of the most highest rated from a safety point of view of all stable coins is what we got from Moody's yesterday.
Gold standard from a regulatory point of view. In plain words, a regulated dollar coin is one its company can freeze. XRP doesn't have one. Remember that, because it decides how this ends. So, let's follow the RLUSD.
Every transfer is public down to the second. At 8:24 p.m. UTC, two Binance wallets sent out RLUSD 24 seconds apart. 62.6 million from one, 25.9 million from the other. $88.5 million of Ripple's coin gone from Binance. It hops through three wallets.
And at 9:33 p.m., all of it lands in one wallet, the hacker's. And 8 minutes later, the hacker starts selling. Not to a person, to trading pools, Curve and Uniswap. Robots that swap $1 coin for another. No questions asked.
RLUSD in, Tether and Circle's coins out. Sent on the other wallets. 10 transactions, a few million at a time. The hacker was racing the freeze. Every minute more RLUSD turned into coins Ripple can't touch.
You can read every one of these transfers yourself for free. Reading the public record instead of the headline is the check that we run with our clients inside of SGS at Altcoin Pro on wherever they own their coins. Every day your sits somewhere you haven't mapped, somebody else's switch decides when you can move them. So, the first link in the description is there. Go ahead and click that and book a call with our team immediately.
But, the hacker didn't get all of it. At 10:00 and 59 seconds p.m. UTC, a transaction hits the RLUSD contract. Two signatures, one instruction, pause the wallet. And the hacker's last sale went through in the same block as the freeze.
The same 12 seconds. That's how close it got. By the end, 40 million 541,065 RLUSD were stuck in the hacker's wallet. It can't be sent. It can't be sold.
Exactly 48 million had gone out before it. 8 minutes after the freeze, Ripple's head of stablecoins posted this. Ripple is closely monitoring reports of a potential exploit involving Binance and its attackers' RLUSD holdings, and we are actively freezing affected funds. The freeze was already done when he typed that. Then at 10:20, Ripple froze one more wallet, not the hacker's, Binance's own.
The one with 62 million came out of it. And I know what you're probably thinking, so Ripple can freeze money whenever it wants? That's exactly what crypto was supposed to get away from. And yes, for R L U S D, it can. On October 29th, that's why 40 million dollars didn't leave with the hacker.
And this is actually a built-in mechanism with stable coins and why you can see banks would want to be able to use it, large corporations would want to be able to use it because it is safer than just some random token getting sold on the blockchain that can't be frozen. But that's for the corporate side, government side, etc. Now, when it comes to us out there, the degenerates that want to see our coins make us millionaires, well, we don't want them frozen, we just have to secure them ourselves. So, what about XRP? Can Ripple do that to XRP?
No, and this isn't my opinion, it's written on XRP Ledger's own document. No one can freeze XRP in the XRP Ledger. And the second sentence, which mattered just as much that night, however, custodial exchanges can always freeze the funds they custody at their own discretion. So, I checked Binance's own XRP. XRP scan labels 160 XRP Ledger wallets as Binance's.
Together, they hold about 2.55 billion XRP. Not one of the 25 biggest sent out a single payment of a million XRP or more on the night of the hack. Binance's XRP didn't move, and that's good news. Here's the other news, Binance's own system lists XRP withdrawals on the XRP Ledger as switched off. The XRP is safe, you just can't take yours out.
Exchanges almost always are custodial and they keep control of your funds and the keys that control those funds, and therefore you should never leave money on an exchange. If it's sitting on the exchange, it's not your money. It is a promise from the exchange.
A promise from the exchange. He said that in 2019 and he was talking about Bitcoin.
You see, if your XRP is on an exchange, you don't actually hold XRP on the ledger. The exchange holds your XRP in wallets that it controls and you hold a balance in the exchange's database system. Now, that balance is a number in their database with your name next to it. It is a claim on the exchange.
So, if your XRP is on Binance, the ledger can't freeze it. Binance can and on October 30th, it had. But, no one can freeze XRP works in both directions and we have a receipt from 5 weeks ago. On September 24th, 2026, hackers hit Bitget, another big exchange. Bitget says 387.5 million dollars was taken.
Part of it was XRP and Bitget published the hackers' XRP address. I read that account on the ledger. It took in 102,976, 680 XRP from Bitget's own wallets on September 24th before midnight UTC. It had pushed all of it out into five new accounts. On October 30th, those five held about 27 XRP between them.
Nobody froze it. Nobody could. At a dollar 20, where XRP sat on October 30th, that's about 124 million dollars worth of XRP gone from the wallets it landed in. So, which one do you actually want? A chain where somebody can freeze a thief or a chain where nobody can freeze you?
You do not get both.
You do not get both. With rUSD on Binance, there was a button and 40 million got stuck. With XRP at Bitget, there wasn't and at 103 million XRP got away. This is exactly why we do tell you all of the facts about crypto, whether it's independent coins or stable coins and this is also why we talk so heavily about holding your own keys. Your If not your keys, not your crypto and exchanges are at risk.
Even the biggest and baddest, Binance.
So, let's put it in one place. 88.5 million RLUSD left Binance, 48 million got traded away before Ripple acted, 40.5 million got frozen, and Ripple caught about 46% of its coins. Is the 48 million gone for good? Not necessarily. It was swapped into other dollar coins, tethers and circles among them, and those two froze billions that night as well.
I didn't trace every single hop, so I'm not going to tell you where it ended up. And XRP itself took a hit, $1.20 when I checked, down about 9% in a day. Not because anyone stole XRP from Binance, but because everybody got scared at once. So, what happens next?
But right now, we've seen some bad actors in the business. We've seen bad actors rob banks, too, right? So, that you can't say that it doesn't happen in in in fiat.
That's the CEO of CME Group, where Bitcoin futures trade, the day before. Banks get robbed, too, and banks have freeze button for exactly that reason. Three things to watch: whether Binance ever puts out a confirmed loss number, second, when XRP withdrawals on the XRP ledger reopen at Binance, third, what Ripple does with the 40.5 million dollars it froze. Frozen isn't the same as returned. So, go back to the two YouTubers, 5.6 billion, 2.7 billion.
Nobody knew, but the public record knew one thing, to the second. Ripple froze 40.5 million dollars, and 48 million got out first.
Anyone holding XRP because no government can touch it has to accept the other half of that same bargain, which is that nobody can touch it when it is stolen, either. That is not a flaw in the design. That is the design.
What nobody can tell you yet is how much Binance really lost. Not CZ, not CoinTelegraph, not me. Ripple can freeze RLUSD. Nobody can freeze XRP. On a night like this, the only freeze you need to worry about is the one on the exchange holding yours.
So, tell me in the comments, is any of your XRP sitting on an exchange tonight? Just a simple yes or no. Everything in this video came off of a public record. One freeze, two signatures, 160 wallets, and a ledger anyone can read. The headline said 5.7 billion.
The record said 40 million frozen and 48 million gone. That's the work. Mapping where your coins actually sit and who holds a button over them is what we do with our clients inside of SGS system at Altcoin Pro. It's for people that are holding $50,000 or more in crypto and who have never had anybody walk through with them. If you're not there yet, well, just keep watching these.
These are free and we're not going to stop making them. If your spouse has a say in where the money goes, bring them onto the call as well. And it's the first link in the description below. Click the link, book the call, get started now. And speaking of clicking links, make sure you smash that subscribe button.
We're on our way to 400,000. And crypto carries risk and past performance doesn't guarantee future results. This is education, not financial advice. And you know what to do. Stay bullish.
I'll see you at the top.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures and quotes are as reported in the video on November 2, 2026 and may have changed since.
