Two 40 Million XRP Transfers Reported From Wallet Labeled “Binance Hack 2026”
Whale Alert reportedly flagged two transfers of 40 million XRP each from a wallet labeled “Binance Hack 2026.” The total, 80 million XRP, was worth about $100.9 million at the reported prices. The transaction date, destination addresses and any link to a Binance security incident have not been independently established.
- Each reported transfer involved 40 million XRP.
- The combined reported value was about $100.9 million.
- The XRP went to two unidentified addresses.
- The wallet label does not prove who controlled the funds or why they moved.
What the alerts reportedly showed
Whale Alert reportedly listed one 40-million-XRP transfer at 03:56 UTC, worth about $50.46 million. Another transfer, 50 seconds earlier, was valued at about $50.44 million. Both were said to have come from the same wallet and gone to separate addresses.
The reported figures cannot be independently checked with the information available here. Transaction hashes and the sending and receiving addresses have not been provided. The origin of the “Binance Hack 2026” label is also unclear. A wallet label is an attribution, not proof of identity, ownership or a connection to a specific incident.
The transfer date is unclear, too. The “2026” in the label does not establish when the transactions happened, and their timing relative to the Binance incident cannot be confirmed without transaction records.
The initial report said there was no sign the XRP had reached an exchange or been sold. That claim cannot be verified without the addresses and a stated monitoring cutoff. Even if on-chain activity shows no transfer to a known exchange address, it cannot rule out an off-chain sale.
What can be said about the Binance connection?
A separate account describes a security incident at Binance on 29 October 2026 and says five Binance wallets sent 233.46 million XRP to one attacker address. That account is a single source, and the materials available here do not independently verify its transaction details. They also do not link the initial movement to the later reported transfers of 40 million XRP each.
The same account describes activity across multiple blockchains and discusses EIP-7702, an Ethereum feature that lets an externally owned account authorize execution using delegated code. The author argues that failures in signing controls may have enabled the activity. That is an interpretation, not a confirmed finding. None of this establishes who controlled the wallet behind the two reported XRP transfers.
The incident account also cites a $6.3 billion figure, but the available information does not provide a complete accounting. Assets moved, assets frozen, recoveries and net losses are different measures. Without a clear reconciliation, the figure should not be treated as a confirmed final loss.
Claims that Binance restored withdrawals in phases, fully backed selected balances or replenished around 95% of affected assets also need confirmation from Binance’s original notices. Those claims are separate from whether these XRP transfers occurred or were connected to the incident.
Key questions and answers
-
How much XRP reportedly moved?
Two transfers of 40 million XRP each, for a total of 80 million XRP. Their reported combined value was about $100.9 million.
-
When did the transfers happen?
The reported alerts give times of 03:56 UTC and 50 seconds earlier, but the available transaction details do not establish the date or year.
-
Does the wallet label prove the XRP came from the Binance incident?
No. The label’s source and basis are unclear, and no transaction trail provided here connects the transfers to the reported incident.
-
Were the XRP sold or sent to an exchange?
The initial report said neither had been observed, but the addresses and monitoring cutoff needed to check that claim are unavailable. An on-chain review also cannot rule out an off-chain sale.
For now, the facts that can be stated are limited: two transfers of 40 million XRP each were reported, but the transaction records, wallet attribution, purpose and connection to Binance remain unresolved. A dramatic label is no substitute for a verifiable trail.
