Key points:

• Ripple has frozen RLUSD worth $40.5 million that is related to the attackers.
• Hackers also stole native XRP worth $296 million.
• XRP cannot be frozen by token restrictions controlled by the issuer.

After Binance encountered a security vulnerability worth $6.3 billion, Ripple successfully froze approximately $40.5 million of the stolen RLUSD, but it was unable to prevent hackers from holding or transferring another $296 million of the original XRP.

According to the blockchain investigation by TRM Labs, Ripple froze RLUSD related to the attackers at 22:01 on October 29th UTC, and managed to preserve 40.5 million of the initially stolen 88.5 million RLUSD.

This intervention highlights the fundamental difference between the Ripple regulated stablecoins and the XRP – XRP Ledger’s native cryptocurrency.

Ripple has frozen RLUSD, but millions of dollars have already flowed out.

The freeze occurred about two hours after the attacker began to sweep Binance wallets across multiple blockchains.

Before the intervention of Ripple, approximately 48 million RLUSD tokens had already been exchanged through decentralized trading platforms, leaving only 40.5 million tokens in the affected wallets.

Ripple also restricted RLUSD within the hot wallets that were compromised by Binance, preventing that address from further unauthorized withdrawals of this stablecoin.

Independent blockchain investigator Range confirmed this timeline, confirming that the first RLUSD freeze occurred at 22:01 UTC, followed by additional restrictions around 22:20 UTC.

Co-CEO Binance stated separately that Ripple helped to prevent the flow of approximately $200 million in funds, however, TRM independently verified only a freeze of $40.5 million.

This intervention is part of a broader set of measures, with participants also including Tether, Circle, and other stablecoin issuers.

As previously reported by Coinpaper in their investigations regarding Binance, the exchange stated that approximately $3 billion in affected crypto assets have been frozen.

However, freezing stolen tokens does not automatically mean that these assets have been returned to Binance or that compensation has been made to the customers.

Why can't Ripple freeze $296 million of XRP?

The same group of attackers stole 233.46 million XRP from 5 Binance wallets earlier that evening, worth approximately 296 million US dollars.

Coinpaper Previous reports regarding the theft of XRP have been traced back to these transfers, which occurred within a 4-minute window between 20:05 and 20:09 on UTC.

Unlike RLUSD, XRP does not have a centralized issuer that possesses management rights or the ability to freeze balances.

XRP Ledger The official documentation clearly distinguishes between the native XRP and the already issued tokens; the latter may come with restrictions controlled by the issuer.

RLUSD is issued by a subsidiary of Ripple and includes compliance features that can prevent the transfer of this stablecoin to specific addresses.

The native XRP does not adopt this structure. Ripple cannot blacklist the XRP address, nor can it cancel a valid network transaction.

This does not prevent exchanges from freezing XRP deposited in their controlled accounts, but it will limit direct intervention with funds stored in independent wallets.

This distinction echoes the previous controversy surrounding the freeze of XRP; at that time, David Schwartz of Ripple defended the restrictions on stablecoins, while emphasizing the different properties of XRP.

Binance The Enlightenment of Hacker Incidents on the Security of XRP

This incident illustrates the trade-off between financial assets controlled by issuers and cryptocurrencies that do not have a centralized freezing mechanism.

Stablecoin control functions can help exchanges and investigators contain stolen funds, but they also grant issuers the ability to restrict legitimate users under certain conditions.

Native XRP has a stronger resistance to unilateral transaction restrictions, however, recovering stolen tokens may still depend on the cooperation of exchanges and other service providers.

We have previously recorded similar issues in the Bitget hacker incident, where the attackers transferred the stolen XRP, and Ripple was unable to directly freeze it.